CVE-2024-28108

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Mar 25, 2024 / Updated: 7mo ago

Additionally, unauthenticated HTML injection can compromise user privacy by displaying sensitive information or misleading content. Additionally, unauthenticated HTML injection can compromise user privacy by displaying sensitive information or misleading content.

phpMyFAQ cross-site scripting CVE-2024-28108 - https://www. redpacketsecurity.com/phpmyfaq -cross-site-scripting-cve-2024-28108/ # CVE # Vulnerability # OSINT # ThreatIntel # Cyber

Medium Severity Description phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6. Read more at https://www.tenable.com/cve/CVE-2024-28108

A vulnerability, which was classified as problematic , has been found in thorsten phpmyfaq 3.2.5 . Affected by this issue is some unknown functionality. The manipulation of the argument contentLink leads to basic cross site scripting. This vulnerability is handled as CVE-2024-28108 . The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding CVE-2024-28108 originally published on CyberSecurityBoard