Which versions of phpMyFAQ are affected by CVE-2026-46364?

phpMyFAQ versions before 4.1.2 contain an unauthenticated SQL injection vulnerability in a public API endpoint that enables remote extraction of admin credentials, authentication tokens, and SMTP…. A patch is available.

Is there a public PoC exploit available for CVE-2026-46364?

Yes, a public proof-of-concept exploit is available for CVE-2026-46364. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-46364?

Within 24 hours: Identify all phpMyFAQ deployments and document current versions. Within 7 days: Upgrade all instances to phpMyFAQ 4.1.2 or later. Within 30 days: Conduct database access logs audit for signs of unauthorized queries, revoke and reissue all SMTP credentials, and reset or reissue all admin authentication tokens as precaution.

phpMyFAQ CVE-2026-46364

Q: What is the CVSS score of CVE-2026-46364?

CVE-2026-46364 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30601 CRITICAL

SQL Injection (CWE-89)

2026-05-15 VulnCheck

GHSA-ch9q-c9mp-j5gq

GHSA-289f-fq7w-6q2w

Information Disclosure SQLi Phpmyfaq

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 28, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

May 28, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Source Code Evidence Fetched

May 15, 2026 - 19:30 vuln.today

Analysis Generated

May 15, 2026 - 19:30 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.

AnalysisAI

Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and SMTP secrets by sending a crafted User-Agent header to the public GET /api/captcha endpoint. The flaw sits in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha(), which interpolate the header into DELETE and INSERT statements via sprintf with no escaping. No public exploit identified at time of analysis, though VulnCheck has published a detailed reachability writeup and a verified time-based blind PoC payload appears in the GHSA advisory.

Technical ContextAI

phpMyFAQ is a PHP-based open-source FAQ management system tracked under CPE cpe:2.3:a:thorsten:phpmyfaq. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In phpmyfaq/src/phpMyFAQ/Captcha/BuiltinCaptcha.php at lines 298 and 330, the $this->userAgent and $this->ip values, populated directly from request headers in the constructor, are concatenated into raw SQL via sprintf() and dispatched through $db->query() without going through the existing Database::escape() helper or a prepared statement. The same file's checkCaptchaCode() at line 472 does use $db->escape(), confirming the sanitizer was available but skipped in the two captcha lifecycle sinks. Both sinks fire on every request to the unauthenticated GET /api/captcha route exposed by CaptchaController.

RemediationAI

Vendor-released patch: upgrade to phpMyFAQ 4.1.2 or later, available from the maintainers per advisory https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w. Composer users should run composer update thorsten/phpmyfaq to pull >=4.1.2. If immediate upgrade is not possible, block or rate-limit the GET /api/captcha endpoint at the reverse proxy or WAF, and strip or whitelist the User-Agent header before it reaches PHP - this will break captcha generation for legitimate users and visually disable the captcha challenge on forms, so plan a maintenance window. A WAF rule rejecting SQL keywords (SLEEP, BENCHMARK, UNION, single quotes) in User-Agent headers is a narrower stopgap but will produce false positives for security scanners and exotic browser strings. Additional vendor context is available at https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-via-user-agent-header-in-builtincaptcha and https://vuldb.com/vuln/364249.