CVE-2026-46364

Critical

Description

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

SeverityCritical

CVSS9.8

Exploit probability—

ProductThorsten/phpmyfaq

PublishedMay 15, 2026

First seenMay 15, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

thorsten/phpmyfaq4.1.2 or later
phpmyfaq/phpmyfaq4.1.2 or later

Patches

github.com/thorsten/phpMyFAQ/commit/b9f25109fddb38eee19987183798638d07943f92

Vendor advisories

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w

Affected products

Product	Affected versions	Fixed in
thorsten/phpmyfaqPackagist	v < 4.1.2	4.1.2
phpmyfaq/phpmyfaqPackagist	v < 4.1.2	4.1.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.