CVE-2026-46361

MediumCVSS 6.9/10Last modified Oct 26, 2026

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

Metrics

CVSS 3.1 6.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
thorsten	phpmyfaq	< 4.1.2

References

Timeline

Published: May 15, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-463626.5phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to CVE-2026-463635.4phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization thr CVE-2026-463649.8phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::save CVE-2026-463655.4phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any CVE-2026-463667.5phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, CVE-2026-463677.6phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject Ja CVE-2026-463688.8luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the Open CVE-2026-463697.5Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity CVE-2026-46375.1Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a reque CVE-2026-463706.5Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoin CVE-2026-463716.5Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing CVE-2026-463728.5SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation