Cross-Site Scripting (XSS) in phpMyFAQ/phpMyFAQ (CVE-2026-46367, CVSS 7.6)

Summary

Cross-site scripting in phpMyFAQ/phpMyFAQ (CVE-2026-46367). Confidential information can be exposed externally. Exploitable via main.enableCommentEditor. Mitigation: upgrade to 4.1.2 or later.

Original description

The description as published by the source.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9525-27vj-c8r8. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

phpMyFAQ 4.1.2未満のバージョンには、Utils::parseUrl()における保存型クロスサイトスクリプティングの脆弱性が存在します。認証済みユーザーが不正なURLをコメントに挿入することでJavaScriptコードを注入でき、管理者のセッションCookieを盗むなどの攻撃が可能です。

❓ What is the problem

phpMyFAQのUtils::parseUrl()における保存型クロスサイトスクリプティング脆弱性。

📍 Affected scope

phpMyFAQ 4.1.2未満のバージョン。

🔥 Severity

攻撃者はJavaScriptを注入し、管理者のセッションを奪取可能。高い影響度。

🔧 How to fix

phpMyFAQを4.1.2以降にアップデートする。

🛡️ Workaround

情報なし

🔍 Detection

アプリケーションログで不審なスクリプトの挿入を確認する。