| Package | Affected versions | Patched versions |
|---|---|---|
| phpmyfaq/phpmyfaq | ≥ 3.2.5, < 3.2.6 | 3.2.6 |
| phpmyfaq | = 3.2.5 |
By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.
news parameter in the POST body with the following payload: %3cscript%3ealert('xssContent')%3c%2fscript%3eThis allows an attacker to execute arbitrary client side JavaScript within the context of another user's phpMyFAQ session
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free