{"id":"CVE-2026-46364","title":"phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha","summary":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries.…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-89"],"vendor":"thorsten","product":"phpmyfaq","affected":["phpmyfaq < 4.1.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-05-15T22:11:13.813389Z"},"exploitAvailable":true,"published":"2026-05-15","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:03:56.193Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46364","references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w","label":"GitHub Security Advisory (GHSA-289f-fq7w-6q2w)"},{"url":"https://github.com/thorsten/phpMyFAQ/commit/b9f25109fddb38eee19987183798638d07943f92","label":"https://github.com/thorsten/phpMyFAQ/commit/b9f25109fddb38eee19987183798638d07943f92"},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-via-user-agent-header-in-builtincaptcha","label":"VulnCheck Advisory: phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha"}],"tags":["cve.org","exploit-available"],"epss":0.01709,"epssPercentile":0.77482,"exploits":{"nuclei":["CVE-2026-46364"],"checkedAt":"2026-11-08T14:51:57.343Z"},"ingestedAt":"2026-11-08T14:51:22.418Z","slug":"CVE-2026-46364","body":"## Overview\n\nphpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n\n## Affected\n\n- `phpmyfaq < 4.1.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[]}