CVE-2024-27300 MEDIUM

CVE-2024-27300: phpMyFAQ Stored XSS at user email

Vendor Thorsten
Product phpMyFAQ
Weakness CWE-79 · XSS
Published March 25, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6.

Key dates

02Disclosure timeline

March 25, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers CVE-2026-78273 WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability