Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "<script>alert(1)</script>"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.
Remediation
References
Related Vulnerabilities
Drupal Core 7.x Security Bypass (7.0 - 7.4)
Craft CMS Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2021-41824)
WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress SQL Injection (3.7.39)
Liferay Portal Missing Release of Memory after Effective Lifetime Vulnerability (CVE-2025-43816)