CVE WatchOct 19, 2026

CVE-2026-111896

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to

CVSS

5.4

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Oct 17, 2026 · Last modified: Oct 19, 2026 · CWE-182

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-182026-10-20

Technical description

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.

Official references

github.comhttps://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf
www.vulncheck.comhttps://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass

Related CVEs

No related CVEs by CWE or product.