CVE-2024-28106
Last modified
CVE-2024-28106 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phpmyfaq | Phpmyfaq | 3.2.5 |
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392rExploit, Vendor Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6p68-36m6-392rExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-28106?
How severe is CVE-2024-28106?
How do I fix CVE-2024-28106?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2810A vulnerability has been found in Tenda AC15 15.03.05.18/15.…9.8
- CVE-2024-28100eLabFTW is an open source electronic lab notebook for resear…5.4
- CVE-2024-28101The Apollo Router is a graph router written in Rust to run a…7.5
- CVE-2024-28102JWCrypto implements JWK, JWS, and JWE specifications using p…6.8
- CVE-2024-28103Action Pack is a framework for handling and responding to we…9.8
- CVE-2024-28105phpMyFAQ is an open source FAQ web application for PHP 8.1+ …7.2
- CVE-2024-28107phpMyFAQ is an open source FAQ web application for PHP 8.1+ …8.8
- CVE-2024-28108phpMyFAQ is an open source FAQ web application for PHP 8.1+ …6.1
- CVE-2024-28109veraPDF-library is a PDF/A validation library. Executing pol…8.1
- CVE-2024-2811A vulnerability was found in Tenda AC15 15.03.20_multi and c…9.8
- CVE-2024-28110Go SDK for CloudEvents is the official CloudEvents SDK to in…7.5
- CVE-2024-28111Canarytokens helps track activity and actions on a network. …6.5
Are you affected by CVE-2024-28106?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST