CVE-2026-46363

描述

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5p7-2c9q-8896. This link is maintained to preserve external references. ### Original Description phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.

如何修補 CVE-2026-46363

要修補 CVE-2026-46363,請將受影響套件升級到下列已修補版本。

• —升級至 4.1.2 或更新版本
• —升級至 4.1.2 或更新版本
• —升級至 4.1.2 或更新版本
• —升級至 4.1.2 或更新版本

CVE-2026-46363 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 4.1.2
• from 0, < 4.1.2
• from 0, < 4.1.2
• from 0, < 4.1.2

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-46363
• PATCHgithub.com/thorsten/phpMyFAQ
• WEBgithub.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896
• WEBwww.vulncheck.com/advisories/phpmyfaq-stored-xss-in-faq-question-answer-via-encode-decode-bypass