Description

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.

Remediation

References

CVE-2024-24574

Related Vulnerabilities

Oracle HTTP Server CVE-2020-2530 Vulnerability (CVE-2020-2530)

Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2024-27184)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-6712)

WordPress 4.5.x Cross-Site Request Forgery (4.5 - 4.5.16)

WordPress Plugin Plug-N-Edit Full Drag & Drop HTML Visual Editor with Web Page Builder WYSIWYG Cross-Site Scripting (5.2.0)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2024-24574