What is GHSA-h36g-93qx-rxgr?

GHSA-h36g-93qx-rxgr is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

Why does GHSA-h36g-93qx-rxgr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-h36g-93qx-rxgr?

GHSA-h36g-93qx-rxgr has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-h36g-93qx-rxgr?

GHSA-h36g-93qx-rxgr affects 2 products, including: composer/phpMyFAQ/phpMyFAQ:\u003c 4.1.2; composer/thorsten/phpMyFAQ:\u003c 4.1.2.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 9, 2026

GHSA-h36g-93qx-rxgrMediumCVSS 5.4Disclosed before NVD

Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

Vendor

GitHub Security Advisories

Published

May 15, 2026

Last Modified

June 9, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-f5p7-2c9q-8896. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

🎯 Affected products2

composer/phpMyFAQ/phpMyFAQ:< 4.1.2
composer/thorsten/phpMyFAQ:< 4.1.2

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products2

🔗 References (4)