Executive brief
Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
Affected products
- Packagist phpmyfaq/phpmyfaq
- Packagist thorsten/phpmyfaq
Junglewise Threat Intelligence
Duplicate Advisory: phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
Severity: low · CVSS 3.1 · Published 2026-05-15
Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.
Related threats
- phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement usin
- phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in
- phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authe
- phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows an
- phpMyFAQ privilege escalation in GroupController::updatePermissions