CVE-2024-28108 Information

Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also requires that adding new FAQs is allowed for guests and that the admin doesn’t check the content of a newly added FAQ. This vulnerability is fixed in 3.2.6.

Reference

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh https://github.com/thorsten/phpMyFAQ/commit/4fed1d9602f0635260f789fe85995789d94d6634