CVE-2026-111903Medium· 5.4▾ SunlitphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.
phpMyFAQ >= 4.2.0-alpha < 4.2.0-betaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111894Medium· 5.4phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
CVE-2026-56736High· 8.2phpMyFAQ is an open source FAQ web application
CVE-2026-85593Medium· 5.4phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection
CVE-2025-68951Medium· 5.4phpMyFAQ is an open source FAQ web application
CVE-2026-111888Low· 2.7phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
CVE-2026-111887Medium· 5.3phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint