This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-111896 | BDVDB-2026-390721 Detail

thorstenphpMyFAQ

Description#

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-182 Collapse of Data into Unsafe Value

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.