VYPR
Moderate severityNVD Advisory· Published Apr 5, 2023· Updated Feb 10, 2025

Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

CVE-2023-1756

Description

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
thorsten/phpmyfaqPackagist
< 3.1.123.1.12

Affected products

2

Patches

Vulnerability mechanics

Root cause

"The absence of a Content Security Policy (CSP) in the HTML5 export generation allows for the execution of malicious scripts."

Attack vector

An attacker can trigger this vulnerability by injecting malicious scripts into content that is subsequently processed by the HTML5 export feature. When a user views the exported HTML5 file, the injected script executes in the context of the user's browser. This is a form of stored XSS where the lack of restrictive security headers allows the execution of unauthorized code [patch_id=24088].

Affected code

The vulnerability is located in `phpmyfaq/src/phpMyFAQ/Export/Html5.php`. The `generate` method fails to implement a Content Security Policy (CSP) for generated HTML5 exports, leaving the output susceptible to stored Cross-Site Scripting (XSS) [patch_id=24088].

What the fix does

The patch modifies `phpmyfaq/src/phpMyFAQ/Export/Html5.php` to include a Content-Security-Policy (CSP) meta tag within the head section of the generated HTML5 output [patch_id=24088]. By setting the policy to `default-src 'self'; img-src https://*; child-src 'none';`, the fix restricts the sources from which content can be loaded and prevents the execution of unauthorized inline scripts. This mitigates the risk of stored XSS by enforcing stricter browser security controls on the exported files [patch_id=24088].

Preconditions

  • configThe application must be running a version of phpmyfaq prior to 3.1.12.

Generated on May 11, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.