Vulnerability · Published May 15, 2026 · Assigned by VulnCheck

CVE-2026-46359phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

High 7.5

In plain English

A high-severity SQL injection in phpmyfaq from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	phpmyfaq/phpmyfaq	4.1.2	GHSA-pm8c-3qq3-72w7
Packagist	thorsten/phpmyfaq	4.1.2	GHSA-pm8c-3qq3-72w7

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpmyfaq	0 – before 4.1.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GHSA Advisory GHSA-pm8c-3qq3-72w7 vendor-advisory
VulnCheck Advisory: phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields third-party-advisory