CVE-2024-28106

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
thorsten	phpMyFAQ	3.2.5
phpmyfaq	phpmyfaq	3.2.5

References

https://github.com/thorsten/phpMyFAQ/commit/c94b3deadd87789389e1fad162bc3dd595c0e15aPatch
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392rExploit, Vendor Advisory
https://github.com/thorsten/phpMyFAQ/commit/c94b3deadd87789389e1fad162bc3dd595c0e15aPatch
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392rExploit, Vendor Advisory

Timeline

Published: Mar 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-281078.8phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has be CVE-2024-281086.1phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the CVE-2024-281098.1veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that coul CVE-2024-28119.8A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart o CVE-2024-281107.5Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevent CVE-2024-281116.5Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CVE-2024-281124.8Peering Manager is a BGP session management tool. Affected versions of Peering Manager are subject to a potential stored Cross-Site Scriptin CVE-2024-281136.1Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a CVE-2024-281149.1Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Executio CVE-2024-281157.8FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against l CVE-2024-281168.8Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Inject CVE-2024-281178.8Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils: