EUVD-2026-244489

fkie_cve-2024-24574

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.

GHSA-7m8g-fprr-47fx — phpMyFAQ vulnerable to stored XSS on attachments filename

Affected: Packagist: phpmyfaq/phpmyfaq

### Summary Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)

### Details On that snippet code of rendering the file attachments from user tables

``` <?php foreach ($crumbs as $item) : ?> <tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>"> <td><?= $item->id ?></td> <td><?= $item->filename ?></td> <td><?= $item->record_lang ?></td> <td><?= Utils::formatBytes($item->filesize) ?></td> <td><?= $item->mime_type ?></td> <td> ```

The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of `Strings::htmlentities` on use `phpMyFAQ\Strings;`

``` <td><?= Strings::htmlentities($item->filename); ?></td> <td><?= Strings::htmlentities($item->record_lang); ?></td> <td><?= Utils::formatBytes($item->filesize) ?></td> <td><?= Strings::htmlentities($item->mime_type); ?></td> ```

Propose fixing on that pull request https://github.com/thorsten/phpMyFAQ/pull/2827

### PoC 1. An attacker with permission will upload the attachments image on [http://{base_url}/admin/?action=editentry](http://{base_url}/admin/?action=editentry) 2. On endpoint of ajax upload image POST /admin/index.php?action=ajax&ajax=att&ajaxaction=upload 3. Change the originally name file on parameters filename to a XSS payload 4. The XSS will trigger on attachment pages /admin/?action=attachments

- Trigger…

openSUSE-SU-2024:13661-1 — libgit2-1_7-1.7.2-1.1 on GA media

libgit2-1_7-1.7.2-1.1 on GA media

Most recent entries from all

EUVD-2026-244489

fkie_cve-2024-24574

GHSA-7m8g-fprr-47fx — phpMyFAQ vulnerable to stored XSS on attachments filename

gsd-2024-24574

openSUSE-SU-2024:13661-1 — libgit2-1_7-1.7.2-1.1 on GA media