PT-2025-53729 · Phpmyfaq · Phpmyfaq

Eclipse07077-Ljw · Published 2025-12-29 · Updated 2026-01-07 · CVE-2025-68951

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.14 through 4.0.15

Description phpMyFAQ is a web application for creating FAQs. Versions 4.0.14 and 4.0.15 contain a stored cross-site scripting (XSS) issue. An attacker can inject and execute arbitrary JavaScript code in an administrator’s browser. This is achieved by registering a user with a display name containing HTML entities. When an administrator views the admin user list, the payload is decoded and rendered without proper escaping, leading to script execution within the administrator's context.

Recommendations Upgrade to phpMyFAQ version 4.0.16 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68951

GHSA-JV8R-HV7Q-P6VC

Affected Products

Phpmyfaq

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68951.json · Exploit
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370 · Patch
• https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87 · Patch
• https://osv.dev/vulnerability/CVE-2025-68951 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv8r-hv7q-p6vc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68951 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://t.me/CVEtracker/40838 · Telegram Post
• https://t.me/cveNotify/147952 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2005690702106185960 · Twitter Post