p PatchFirst

CVE-2024-28106

CVE-2024-28106 · phpMyFAQ Stored XSS at FAQ News Content

This page contains facts from public vulnerability sources. Check the original advisory before updating.

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.

CVSS 4.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • phpmyfaq

    Versions
    • 3.2.5: Affected

    No fix published

  • phpmyfaq/phpmyfaq Packagist

    Versions
    • 3.2.5
    Affected ranges
    • ECOSYSTEM: ≥ 3.2.5, < 3.2.6

    Update to 3.2.6

Original sources

Check your server →