CVE-2026-46361CWE-79

phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig

High · published May 15, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-15T18:36Z
EPSS history
Timeline
  • 15 MAY 18:36Z
    phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig
    cvelistv5