CVE-2026-46367: phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46367?
CVE-2026-46367 is classified as a stored cross-site scripting vulnerability which poses a moderate to high security risk.
How do I fix CVE-2026-46367?
To fix CVE-2026-46367, upgrade phpMyFAQ to version 4.1.2 or later.
Who is affected by CVE-2026-46367?
CVE-2026-46367 affects all versions of phpMyFAQ prior to 4.1.2.
What types of attacks can be executed using CVE-2026-46367?
Attackers can exploit CVE-2026-46367 to inject malicious JavaScript into comments, potentially compromising authenticated users.
Is authentication required for exploitation of CVE-2026-46367?
Yes, exploitation of CVE-2026-46367 requires the attacker to be an authenticated user.