CVE-2026-46367 | THREATINT

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

PUBLISHED Reserved 2026-05-13 | Published 2026-05-15 | Updated 2026-05-16 | Assigner VulnCheck

HIGH: 7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unaffected

4.1.1 (semver) before 4.1.2

affected

4.1.2 (semver)

unaffected

Credits

ericliu-12 reporter

References

github.com/...pMyFAQ/security/advisories/GHSA-9525-27vj-c8r8 exploit

github.com/...pMyFAQ/security/advisories/GHSA-9525-27vj-c8r8 (GHSA Advisory GHSA-9525-27vj-c8r8) vendor-advisory

www.vulncheck.com/...via-utils-parseurl-in-comment-rendering (VulnCheck Advisory: phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering) third-party-advisory

cve.org (CVE-2026-46367)

nvd.nist.gov (CVE-2026-46367)

Download JSON