CVE Watch19 oct 2026

CVE-2026-111896

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to

CVSS

5.4

Medio

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 17 oct 2026 · Última mod.: 19 oct 2026 · CWE-182

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-10-182026-10-20

Descripción técnica

phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.

Referencias oficiales

github.comhttps://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf
www.vulncheck.comhttps://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass

CVEs relacionados

Sin CVEs relacionados por CWE o producto.