Stored Cross-Site Scripting Vulnerability in phpMyFAQ Affects Versions 4.0.14 and 4.0.15

CVE-2025-68951

What is CVE-2025-68951?

phpMyFAQ, an open-source FAQ web application, has a vulnerability in versions 4.0.14 and 4.0.15 that allows for stored cross-site scripting. By registering a user with a display name that includes HTML entities, an attacker can execute malicious JavaScript in an administrator's browser. When the administrator views the user list, the server decodes this payload improperly, leading to script execution within the admin's context. A patch addressing this issue is available in version 4.0.16.

References