GHSA-jph3-3j24-pg3j

ghsaUSosv

thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter

view advisory published 2023-04-05Licence: CC-BY-4.0

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting (XSS) because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1882US	medium5.4	0.53% (45th)	—	2023-04-05
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

references

External citations — patches, advisories, analysis.

https://github.com/thorsten/phpMyFAQPACKAGE
https://github.com/thorsten/phpmyfaq/commit/49db615c300ae0f87795f20570f6f5bdccb1d2f2WEB
https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1882ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan