VDB
CISA-2024-24574
CISA-2024-24574
PUBLISHED
CVSS 6.5 MEDIUM
Reported by GitHub_M · Published February 5, 2024
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| thorsten | phpMyFAQ | < 3.2.5 |
| thorsten | phpMyFAQ | < 3.2.5, < 3.2.5 |
Timeline
- Feb 5, 2024 CVE Published
- Jun 17, 2025 CVE Updated
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx x_refsource_CONFIRM
- https://github.com/thorsten/phpMyFAQ/pull/2827 x_refsource_MISC
- https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5 x_refsource_MISC