PT-2026-41365 · Phpmyfaq · Phpmyfaq

Offset · Published 2026-05-06 · Updated 2026-05-16 · CVE-2026-46363

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description A stored cross-site scripting issue exists in the FAQ creation and update endpoints. Authenticated attackers with FAQ ADD permission can bypass sanitization through encode-decode cycles to inject malicious script tags via the question or answer parameters. These scripts execute in the browser of any visitor when the FAQ content is rendered using the raw Twig filter (a filter that outputs content without escaping).

Recommendations Update to version 4.1.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-46363

GHSA-F5P7-2C9Q-8896

GHSA-H36G-93QX-RXGR

Affected Products

Phpmyfaq

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46363.json · Exploit
• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896 · Exploit
• https://osv.dev/vulnerability/CVE-2026-46363 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5p7-2c9q-8896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h36g-93qx-rxgr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46363 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://vulncheck.com/advisories/phpmyfaq-stored-xss-in-faq-question-answer-via-encode-decode-bypass · Note
• https://twitter.com/f1tym1/status/2055509628000067752 · Twitter Post