VulnSocial

CVE-2026-45010Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-307

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-05-15); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-15: 1Mentions · 2026-05-16: 1Patch / Workaround · 2026-05-15: 1Patch / Workaround · 2026-05-16: 1Technical Details · 2026-05-15: 1Technical Details · 2026-05-16: 105-1505-16
Signal classification1 categories
Patch
2100.0%
Full discourse2 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨 Critical - Multiple phpMyFAQ Vulnerabilities (CVE-2026-46364, CVE-2026-45010) phpMyFAQ contains critical vulnerabilities that may allow unauthenticated attackers to perform SQL injection through crafted User-Agent headers and brute-force TOTP authentication codes via the /admin/check endpoint. Successful exploitation could lead to credential disclosure and full administrative account takeover. 👉 Affected: phpMyFAQ < 4.1.2 | Fix: Upgrade to 4.1.2

    Post summary

    phpMyFAQ versions below 4.1.2 contain critical SQL injection and TOTP brute‑force flaws that allow credential theft and full admin takeover; upgrading to 4.1.2 addresses the issue.

    00020121
    255 followersView on X
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-45010 — CVSS 9.1/10 █████████░ phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/TKacEhVxCq

    Post summary

    The tweet announces the critical CVE-2026-45010 in phpMyFAQ, provides technical details and urges users to apply the available patch.

    10010228
    42 followersView on X

Explore more

Back to dashboard