CVE-2024-24574CWE-79CWE-80

phpMyFAQ vulnerable to stored XSS on attachments filename

Medium · published February 5, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00880 · 58.7th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-02-05T20:57Z
EPSS history
Timeline
  • 05 FEB 20:57Z
    phpMyFAQ vulnerable to stored XSS on attachments filename
    cvelistv5