CVE-2026-111894

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

The software phpMyFAQ (versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure in the FaqHelper::cleanUpContent() function, which allows authenticated content authors to bypass the hostless media-host al...

EUVD-2026-103325

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894: Improper Neutralization of Input During Web Page Generation

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

PT-2026-116465

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.1 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description Authenticated content authors can perform stored cross-site scripting by embedding iframes with data:text/html sources within FAQ or News...