GHSA-wwmv-7qmx-vxv3MediumCVSS 5.4
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site...
🔗 CVE IDs covered (1)
📋 Description
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.
🔗 References (4)
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq
- https://nvd.nist.gov/vuln/detail/CVE-2026-111894
- https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri
- https://github.com/advisories/GHSA-wwmv-7qmx-vxv3