CVE-2026-46364: phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46364?
CVE-2026-46364 is classified as a critical SQL injection vulnerability in phpMyFAQ.
How do I fix CVE-2026-46364?
To fix CVE-2026-46364, update phpMyFAQ to version 4.1.2 or later.
What methods are affected by CVE-2026-46364?
CVE-2026-46364 affects the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods.
Is CVE-2026-46364 an authenticated or unauthenticated vulnerability?
CVE-2026-46364 is an unauthenticated SQL injection vulnerability.
Which version of phpMyFAQ is vulnerable to CVE-2026-46364?
phpMyFAQ versions before 4.1.2 are vulnerable to CVE-2026-46364.