Skip to content
Threat Feed

Product

PhpMyFAQ < 4.1.2

1 brief RSS
high advisory

phpMyFAQ Stored XSS Vulnerability via Malformed URLs (CVE-2026-46367)

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments, potentially leading to session hijacking and application takeover.

phpMyFAQ < 4.1.2 stored-xss xss phpmyfaq
2r 1c