CVE-2026-46364: falha crítica em thorsten phpmyfaq
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
Publicada em · Atualizada em
43Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 9.3epss 2.1%
probabilidade de exploração
2.1%top 19% das CVEs
exploração observada
nãonenhuma fonte reporta
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
thorsten · phpmyfaqCVEs relacionadas — thorsten phpmyfaq
No mesmo produto, das mais perigosas para as menos.
CVE-2026-45010CRITICALphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointEPSS 0.6%CVE-2026-46362HIGHphpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission CheckEPSS 0.5%CVE-2026-45008HIGHphpMyFAQ - Path Traversal in Client::deleteClientFolder via URL ParameterEPSS 0.5%CVE-2026-46366HIGHphpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission BypassEPSS 0.4%CVE-2026-46359HIGHphpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token FieldsEPSS 0.4%CVE-2026-46361HIGHphpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twigEPSS 0.3%