Vulnerability · Published May 15, 2026 · Assigned by VulnCheck

CVE-2026-46364phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

Critical 9.8

In plain English

A critical-severity SQL injection in phpmyfaq from thorsten. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.7%top 22.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	phpmyfaq/phpmyfaq	4.1.2	GHSA-289f-fq7w-6q2w
Packagist	thorsten/phpmyfaq	4.1.2	GHSA-289f-fq7w-6q2w

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpmyfaq	0 – before 4.1.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA Advisory GHSA-289f-fq7w-6q2w vendor-advisory
https://github.com/thorsten/phpMyFAQ/commit/b9f25109fddb38eee19987183798638d07943f92 patch
VulnCheck Advisory: phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha third-party-advisory