GitHub Advisoryadvisory · Packagist

GHSA-8595-6653-96p2 phpMyFAQ vulnerable to Stored Cross-site Scripting

MEDIUM Published 2023-04-30 Modified 2025-01-30 Official page ↗
Aliases
CVE-2023-2428
Ecosystem
Packagist
Packages
thorsten/phpmyfaq
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-05-01

Affected packages

• Packagist thorsten/phpmyfaq: < 3.1.13 → fixed in 3.1.13

Description

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in `name` field in add question module. This allows an attacker to steal user cookies.

Related

Alias · CVE (1)

  • CVE-2023-2428 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References