CVE-2026-46363 — Vulnerability intelligence
—
Published:
- CVSS
- 5.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.