CVE-2024-27300

Summary: CVE-2024-27300 affects phpMyFAQ; the vulnerability is a stored XSS in the user email field caused by inadequate validation from PHP’s FILTER_VALIDATE_EMAIL. An attacker can inject JavaScript that is stored and later rendered in another user’s session. The issue is documented across multi...

CVE-2024-27300 phpMyFAQ Stored XSS at user email

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The email field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's FILTERVALIDATEEMAIL function, which only validates the email format, not...