CVE-2025-68951Medium· 5.4▾ SunlitphpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
phpmyfaq >= 4.0.14, < 4.0.16phpmyfaq = 4.1.0Upgrade past the affected range:
phpmyfaq 4.0.16Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111894Medium· 5.4phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
CVE-2026-111903Medium· 5.4phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
CVE-2026-56736High· 8.2phpMyFAQ is an open source FAQ web application
CVE-2026-85593Medium· 5.4phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection
CVE-2026-116182Medium· 5.0phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
CVE-2026-116183High· 7.5phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID