p PatchFirst

CVE-2024-27300

CVE-2024-27300 · phpMyFAQ Stored XSS at user email

This page contains facts from public vulnerability sources. Check the original advisory before updating.

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6.

CVSS 5.5 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • phpmyfaq

    Versions
    • 3.2.5: Affected

    No fix published

  • phpmyfaq/phpmyfaq Packagist

    Versions
    • 3.2.5
    Affected ranges
    • ECOSYSTEM: ≥ 3.2.5, < 3.2.6

    Update to 3.2.6

Original sources

Check your server →