phpMyFAQ XSS

The vulnerability of the htmlentitydecode function in the phpMyFAQ/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php file of the phpMyFAQ web application is related to the lack of security measures for the website’s structure. Exploiting this vulnerability could allow an attacker to perform...

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

PT-2026-41489

Summary The FAQ creation and update endpoints in phpMyFAQ apply FILTER SANITIZE SPECIAL CHARS which HTML-encodes input, then immediately call html entity decode which reverses the encoding, followed by Filter::removeAttributes which only strips HTML attributes — not tags. This allows , , , and ta...