CVE-2023-2428

MEDIUM6.1EPSS 0.17%

phpMyFAQ vulnerable to Stored Cross-site Scripting

Published: 4/30/2023Modified: 1/30/2025

Description

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in `name` field in add question module. This allows an attacker to steal user cookies.

Affected packages (1)

Packagist/thorsten/phpmyfaqfrom 0, < 3.1.13

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-2428
PATCHhttps://github.com/thorsten/phpmyfaq
WEBhttps://github.com/thorsten/phpmyfaq/commit/0a4980d870bac92df945f6d022726c4e3ed584ab
WEBhttps://huntr.com/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e
WEBhttps://huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e