CVE-2026-46359CWE-89

phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

High · published May 15, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-15T18:36Z
EPSS history
Timeline
  • 15 MAY 18:36Z
    phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields
    cvelistv5