PT-2026-41366 · Phpmyfaq · Phpmyfaq

Adrgs · Published 2026-05-06 · Updated 2026-06-11 · CVE-2026-46364

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description An unauthenticated SQL injection exists in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods. The issue occurs when unsanitized User-Agent headers are interpolated into DELETE and INSERT queries. Unauthenticated attackers can exploit the ' /api/captcha' endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, which allows for the extraction of sensitive data such as user credentials, admin tokens, and SMTP credentials from the database. Over 1,200 potentially affected devices have been identified.

Recommendations Update to version 4.1.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-46364

GHSA-289F-FQ7W-6Q2W

GHSA-CH9Q-C9MP-J5GQ

Affected Products

Phpmyfaq

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46364.json · Exploit
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ/commit/b9f25109fddb38eee19987183798638d07943f92 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-46364 · Security Note
• https://osv.dev/vulnerability/GHSA-ch9q-c9mp-j5gq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46364 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-289f-fq7w-6q2w · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://reddit.com/r/CVEWatch/comments/1ttnlqe/top_10_trending_cves_01062026 · Reddit Post
• https://twitter.com/pdnuclei_bot/status/2065086690235138291 · Twitter Post
• https://twitter.com/0x0smilex/status/2060837099667177590 · Twitter Post
• https://vulncheck.com/advisories/phpmyfaq-sql-injection-via-user-agent-header-in-builtincaptcha · Note
• https://twitter.com/OrizonCyber/status/2055370186358755637 · Twitter Post
• https://twitter.com/fofabot/status/2056698788874777079 · Twitter Post
• https://twitter.com/UpwindMDR/status/2055518849143857377 · Twitter Post