CVE-2026-46367

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

phpMyFAQ before version 4.1.2 contains a stored cross-site scripting vulnerability in the Utils::parseUrl() function. This allows authenticated users to inject JavaScript via malformed URLs in comments.

Risk Assessment

Attackers can craft URLs with unescaped quotes, allowing them to steal admin session cookies and achieve full application takeover when visitors view affected FAQ pages.

Recommendation

It is recommended to update phpMyFAQ to version 4.1.2 or later to mitigate this vulnerability. Additionally, input validation and sanitization for comments should be implemented.

Original NVD description (English source)

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.