GHSA-v6g2-jwrm-h5r5
phpMyFAQ Cross-site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | thorsten/phpmyfaq | < 3.2.0-beta.2 | 3.2.0-beta.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.
References
External links from the advisory. They lead to third-party sites.