CVE-2026-46363: medium-severity vulnerability in thorsten phpmyfaq
phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
thorsten · phpmyfaqRelated CVEs — thorsten phpmyfaq
In the same product, most dangerous first.
CVE-2026-46364CRITICALphpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptchaEPSS 1.7%CVE-2026-45010CRITICALphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointEPSS 0.4%CVE-2026-46366HIGHphpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission BypassEPSS 0.3%CVE-2026-46362HIGHphpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission CheckEPSS 0.3%CVE-2026-46361HIGHphpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twigEPSS 0.3%CVE-2026-45008HIGHphpMyFAQ - Path Traversal in Client::deleteClientFolder via URL ParameterEPSS 0.3%