Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-46363

phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thorsten phpmyfaq

Default version status: unaffected

  • 0 to < 4.1.2affected
  • 4.1.2unaffected

References