Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
phpMyFAQ Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2024-28108 - Vulnerability Database
phpMyFAQ

phpMyFAQ Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2024-28108

Medium
Reference: CVE-2024-28108
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-28108
Title: phpMyFAQ Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

phpMyFAQ is an open source FAQ web application for PHP 8.1 and MySQL PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also requires that adding new FAQs is allowed for guests and that the admin doesn39t check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6.