ByteOS Network

NVD Vulnerability Details :

CVE-2026-46361

Received

Source-disclosure@vulncheck.com

Published At-15 May, 2026 | 19:17

Updated At-16 May, 2026 | 02:16

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	disclosure@vulncheck.com

CWE ID: CWE-79

Type: Secondary

Source: disclosure@vulncheck.com

References

Hyperlink	Source	Resource
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pqh6-8fxf-jx22	disclosure@vulncheck.com	N/A
https://www.vulncheck.com/advisories/phpmyfaq-stored-cross-site-scripting-via-raw-filter-in-search-twig	disclosure@vulncheck.com	N/A
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pqh6-8fxf-jx22	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A