CVE-2026-46364 — Vulnerability intelligence

thorsten — phpmyfaq

Published: 2026-05-15T18:36:42.869Z

CVSS

9.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

Sources

• CVE-2026-46364
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-46364