High severity7.6NVD Advisory· Published May 15, 2026· Updated May 28, 2026

CVE-2026-46367

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
thorsten/phpmyfaqPackagist	>= 4.1.1, < 4.1.2	4.1.2
phpmyfaq/phpmyfaqPackagist	>= 4.1.1, < 4.1.2	4.1.2

Affected products

Thorsten/Phpmyfaqllm-fuzzy
Range: <4.1.2

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

7.6/ 10

CVSS v48.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected

Source repo: github.com/thorsten/phpMyFAQ

EPSS

Probability of exploitation in the next 30 days.

0.22%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-116
Improper Encoding or Escaping of Output
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE ID

CVE-2026-46367

Credits

E
ericliu-12
reporter · ghsa