CVE-2023-4007
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository thorsten/phpmyfaq prior to version 3.1.16, allowing for the storage of malicious code.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 3.1.16 or later to mitigate this vulnerability.
Other vulnerabilities in thorsten/phpmyfaq
See all- CVE-2023-4006Critical
In the GitHub repository thorsten/phpmyfaq prior to version 3.1.16, there is improper neutralization of formula elements in a CSV file.
- CVE-2023-3469Medium
The thorsten/phpmyfaq GitHub repository prior to version 3.2.0-beta.2 is vulnerable to reflected Cross-site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in users' browsers.
Original NVD description (English source)
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS