Description
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | < 4.1.8 | 4.1.8 |
References
- GitHub Security Advisory (GHSA-x6qj-5jhf-xgpm) vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode third-party-advisory