What’s Vulnerable › Vulnerabilities

CVE-2026-46359: phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-15 · updated 2026-10-26
• Weakness: CWE-89

Description

phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.

Affected products

• thorsten phpMyFAQ: before 4.1.2 — fixed in 4.1.2

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7
• https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-in-currentuser-settokendata-via-unescaped-oauth-token-fields
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7

Get alerted when CVE-2026-46359 or the next vulnerability affects your stack