GHSA-v6g2-jwrm-h5r5

ghsaUSosv

phpMyFAQ Cross-site Scripting

view advisory published 2023-06-30Licence: CC-BY-4.0

phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3469US	medium4.8	0.58% (47th)	—	2023-06-30
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.

references

External citations — patches, advisories, analysis.

https://github.com/thorsten/phpMyFAQPACKAGE
https://github.com/thorsten/phpmyfaq/commit/04a0183c25dd425f4c2bfb5f75b7650b932ae278WEB
https://huntr.dev/bounties/3565cfc9-82c4-4db8-9b8f-494dd81b56caWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-3469ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan