CVE-2024-28108
CVE-2024-28108 · phpMyFAQ Stored HTML Injection at contentLink
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6.
CVSS 4.7 · Media · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
phpmyfaq
- Versiones
- 3.2.5: Afectada
Sin corrección publicada
phpmyfaq/phpmyfaq Packagist
- Versiones
- 3.2.5
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 3.2.5, < 3.2.6
Actualiza a 3.2.6