PT-2026-41369 · Phpmyfaq · Phpmyfaq

Ericliu-12 · CVE-2026-46367 · Published 2026-05-06 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description A stored cross-site scripting issue exists in the parseUrl() function of the Utils class. Authenticated users can inject JavaScript by submitting malformed URLs in comments. By using unescaped quotes to inject event handlers, attackers can steal administrator session cookies, potentially leading to a full application takeover when users view the affected FAQ pages.

Recommendations Update to version 4.1.2 or later. As a temporary workaround, restrict the ability of users to post URLs in comments until the update is applied.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2026-46367

GHSA-9525-27VJ-C8R8

GHSA-W42G-JJ8W-FJ77

Affected Products

Phpmyfaq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46367.json · Exploit
• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9525-27vj-c8r8 · Exploit
• https://osv.dev/vulnerability/GHSA-w42g-jj8w-fj77 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46367 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9525-27vj-c8r8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46367 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://vulncheck.com/advisories/phpmyfaq-stored-xss-via-utils-parseurl-in-comment-rendering · Note