GHSA-jvjx-qqh7-6x6c

ghsaUSosv

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter

view advisory published 2023-04-05Licence: CC-BY-4.0

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ News link parameter. This has been fixed in 3.1.12.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1757US	medium5.4	0.53% (45th)	—	2023-04-05
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

references

External citations — patches, advisories, analysis.

https://github.com/thorsten/phpMyFAQPACKAGE
https://github.com/thorsten/phpmyfaq/commit/5061e5841be6c218ebb0de0cbf7b7f195dc46d19WEB
https://huntr.dev/bounties/584a200a-6ff8-4d53-a3c0-e7893edff60cWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1757ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan