https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 13:23:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322434 EUVD-2026-322434 https://cve.radiocsirt.org/vuln/euvd-2026-322434 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46361 <p>phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor&#39;s browser context including administrators.</p> <p>phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor&#39;s browser context including administrators.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46361 https://cve.radiocsirt.org/vuln/ghsa-pqh6-8fxf-jx22 <p><strong>Affected:</strong> Packagist: phpmyfaq/phpmyfaq, Packagist: thorsten/phpmyfaq</p> <p>## Summary</p> <p>The search result rendering template (`search.twig`) outputs FAQ content fields `result.question` and `result.answerPreview` using Twig&#39;s `| raw` filter, which completely disables the template engine&#39;s built-in auto-escaping.</p> <p>A user with FAQ editor/contributor privileges can store a payload encoded as HTML entities. During search result construction, `html_entity_decode(strip_tags(...))` restores the raw HTML tags — bypassing `strip_tags()` — and the restored payload is injected into every visitor&#39;s browser via the `| raw` output.</p> <p>This vulnerability is distinct from GHSA-cv2g-8cj8-vgc7 (affects `faq.twig`, bypass via regex mismatch in `Filter::removeAttributes()`) and is not addressed by the 4.1.1 patch.</p> <p>---</p> <p>## Affected Files</p> <p>| File | Location | Issue | |---|---|---| | `phpmyfaq/assets/templates/default/search.twig` | lines rendering `result.question`, `result.answerPreview` | `(Vertical Bar) raw` disables autoescape | | `phpmyfaq/src/phpMyFAQ/Controller/Api/SearchController.php` | search result processing loop | `html_entity_decode(strip_tags(...))` restores encoded payloads | | `phpmyfaq/src/phpMyFAQ/Search.php` | `logSearchTerm()` | No HTML sanitization on stored search term (secondary, preventive) |</p> <p>---</p> <p>## Details</p> <p>### Vulnerability A (Primary): `search.twig` — `| raw` Disables Autoescape</p> <p>**File:** `phpmyfaq/assets/templates/default/search.twig`</p> <p>```twig &lt;a title=&#34;Test&#34; href=&#34;{{ result.url }}&#34;&gt;{{ result.question | raw }}&lt;/a&gt; &lt;small class=&#34;small&#34;&gt;{{ r…</p> <p><strong>Affected:</strong> Packagist: phpmyfaq/phpmyfaq, Packagist: thorsten/phpmyfaq</p> <p>## Summary</p> <p>The search result rendering template (`search.twig`) outputs FAQ content fields `result.question` and `result.answerPreview` using Twig&#39;s `| raw` filter, which completely disables the template engine&#39;s built-in auto-escaping.</p> <p>A user with FAQ editor/contributor privileges can store a payload encoded as HTML entities. During search result construction, `html_entity_decode(strip_tags(...))` restores the raw HTML tags — bypassing `strip_tags()` — and the restored payload is injected into every visitor&#39;s browser via the `| raw` output.</p> <p>This vulnerability is distinct from GHSA-cv2g-8cj8-vgc7 (affects `faq.twig`, bypass via regex mismatch in `Filter::removeAttributes()`) and is not addressed by the 4.1.1 patch.</p> <p>---</p> <p>## Affected Files</p> <p>| File | Location | Issue | |---|---|---| | `phpmyfaq/assets/templates/default/search.twig` | lines rendering `result.question`, `result.answerPreview` | `(Vertical Bar) raw` disables autoescape | | `phpmyfaq/src/phpMyFAQ/Controller/Api/SearchController.php` | search result processing loop | `html_entity_decode(strip_tags(...))` restores encoded payloads | | `phpmyfaq/src/phpMyFAQ/Search.php` | `logSearchTerm()` | No HTML sanitization on stored search term (secondary, preventive) |</p> <p>---</p> <p>## Details</p> <p>### Vulnerability A (Primary): `search.twig` — `| raw` Disables Autoescape</p> <p>**File:** `phpmyfaq/assets/templates/default/search.twig`</p> <p>```twig &lt;a title=&#34;Test&#34; href=&#34;{{ result.url }}&#34;&gt;{{ result.question | raw }}&lt;/a&gt; &lt;small class=&#34;small&#34;&gt;{{ r…</p> https://cve.radiocsirt.org/vuln/ghsa-pqh6-8fxf-jx22