medium6.1
CVE-2023-2428
phpMyFAQ vulnerable to Stored Cross-site Scripting
Impact
phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in `name` field in add question module. This allows an attacker to steal user cookies.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | thorsten/phpmyfaq | < 3.1.13 | 3.1.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpmyfaq | Phpmyfaq | before 3.1.13 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/thorsten/phpmyfaq/commit/0a4980d870bac92df945f6d022726c4e3ed584ab
- https://huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e
- https://huntr.com/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e
- https://github.com/advisories/GHSA-8595-6653-96p2
- https://nvd.nist.gov/vuln/detail/CVE-2023-2428