https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:05:24.452988+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-14267 bdu:2026-14267 2026-10-03T03:05:24.517705+00:00 bdu:2026-14267 https://cve.radiocsirt.org/vuln/euvd-2026-367860 EUVD-2026-367860 2026-10-03T03:05:24.517784+00:00 EUVD-2026-367860 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85593 fkie_cve-2026-85593 2026-10-03T03:05:24.517799+00:00

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.

 https://cve.radiocsirt.org/vuln/ghsa-2xm9-x25x-7x5q GHSA-2xm9-x25x-7x5q 2026-10-03T03:05:24.517830+00:00

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.