PT-2026-41489

Summary The FAQ creation and update endpoints in phpMyFAQ apply FILTER SANITIZE SPECIAL CHARS which HTML-encodes input, then immediately call html entity decode which reverses the encoding, followed by Filter::removeAttributes which only strips HTML attributes — not tags. This allows , , , and ta...