CVE-2026-56736
Last modified
CVE-2026-56736 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry.
Description
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization. Version 4.2.0-alpha fixes the issue.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-56736?
How severe is CVE-2026-56736?
How do I fix CVE-2026-56736?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56730Zammad is a web based open source helpdesk/customer support …2.1
- CVE-2026-56731Zammad is a web based open source helpdesk/customer support …8.4
- CVE-2026-56732Zammad is a web based open source helpdesk/customer support …5.3
- CVE-2026-56733Zammad is a web based open source helpdesk/customer support …8.7
- CVE-2026-56734Zammad is a web based open source helpdesk/customer support …5.3
- CVE-2026-56735Zammad is a web based open source helpdesk/customer support …5.3
- CVE-2026-56737phpMyFAQ is an open source FAQ web application. Versions 3.2…8.1
- CVE-2026-56738phpMyFAQ is an open source FAQ web application. The `StopWor…8.5
- CVE-2026-56739Logto is the modern, open-source auth infrastructure for Saa…8.5
- CVE-2026-5674A flaw was found in PipeWire, a multimedia server. This vuln…8.8
- CVE-2026-56740JLine is a Java library for handling console input. Prior to…7.5
- CVE-2026-56741JLine is a Java library for handling console input. Prior to…7.5
Are you affected by CVE-2026-56736?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST