CVE-2023-2428: phpMyFAQ vulnerable to Stored Cross-site Scripting

April 30, 2023 (updated January 30, 2025)

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies.

References

github.com/advisories/GHSA-8595-6653-96p2
github.com/thorsten/phpmyfaq
github.com/thorsten/phpmyfaq/commit/0a4980d870bac92df945f6d022726c4e3ed584ab
huntr.com/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e
huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e
nvd.nist.gov/vuln/detail/CVE-2023-2428

Code Behaviors & Features

Detect and mitigate CVE-2023-2428 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →