VulnerabilityAnalyzed
CVE-2024-29179
An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.
MEDIUM 4.8EPSS 0.51%
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.51% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- phpmyfaq/phpmyfaq
- Source
- security-advisories@github.com
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9Exploit, Vendor Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.