CVE-2024-28106: phpMyFAQ Stored Cross-site Scripting at FAQ News Content

March 25, 2024

By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers.

References

github.com/advisories/GHSA-6p68-36m6-392r
github.com/thorsten/phpMyFAQ
github.com/thorsten/phpMyFAQ/commit/c94b3deadd87789389e1fad162bc3dd595c0e15a
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392r
nvd.nist.gov/vuln/detail/CVE-2024-28106

Detect and mitigate CVE-2024-28106 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →