CVE-2024-28106CWE-79

phpMyFAQ Stored XSS at FAQ News Content

Medium · published March 25, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-03-25T18:41Z
EPSS history
Timeline
  • 25 MAR 18:41Z
    phpMyFAQ Stored XSS at FAQ News Content
    cvelistv5