Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
CVE-2023-5320

9CRITICAL

Key Information:

Vendor

Thorsten

Status
Thorsten/pHPMyFAQ
Vendor
CVE Published:
30 September 2023

What is CVE-2023-5320?

A Cross-Site Scripting (XSS) vulnerability exists in phpMyFAQ, allowing attackers to inject malicious scripts into web pages viewed by users. Versions prior to 3.1.18 are susceptible to this flaw, potentially enabling unauthorized access to sensitive data and user sessions. It's crucial for users to update to the latest version to mitigate any risks associated with this vulnerability.

Affected Version(s)

thorsten/phpmyfaq < 3.1.18

References

https://huntr.dev/bounties/3a2bc18b-5932-4fb5-a01e-24b2b0...
https://github.com/thorsten/phpmyfaq/commit/e923695439597...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.