https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:57:21.409434+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-85593 CVE-2026-85593 — phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode 2026-10-07T22:57:21.424658+00:00

Affected: thorsten phpMyFAQ

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.