phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha (CVE-2026-46364) | HOL Guard CVE