CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100673

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720

Froxlor versions 2.0.0 through 2.3.10 are vulnerable to stored cross-site scripting (XSS) . The issue occurs when a customer uploads an SSL certificate; the Certificates API add()/update() methods parse the certificate using openssl_x509_parse() and store the issuer organization (issuer['O']) val...

EUVD-2026-87693

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

EUVD-2026-87767

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100673 Grav Data Manager before 1.4.5 Stored XSS via item-detail view

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags'' call that PHP's striptags bypasses ...

CVE-2026-100673: Improper Neutralization of Input During Web Page Generation

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags' ' call that PHP's striptags bypasses...

CVE-2026-100720: Improper Neutralization of Input During Web Page Generation

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

PT-2026-99344

Name of the Vulnerable Software and Affected Versions Grav Data Manager versions 1.0.1 through 1.4.4 Description Stored data entries in the item-detail view admin/templates/partials/item.html.twig are rendered without proper escaping due to the use of Twig's raw filter. In certain instances, a...

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

GHSA-PGWP-VC7Q-CVJ3 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

CVE-2026-56736

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

EUVD-2026-86010

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-56736

The open-source FAQ web application phpMyFAQ is vulnerable to a stored cross-site scripting (XSS) flaw in versions prior to 4.2.0-alpha . The root cause is an HTML entity bypass where the html_entity_decode() function converts entities into executable HTML after strip_tags() has already processed...

CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...

CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting XSS vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a...