What is GHSA-974q-4vvr-vg9c?

GHSA-974q-4vvr-vg9c is a security advisory published by GitHub Security Advisories with Medium severity. thorsten/phpmyfaq vulnerable to cross-site scripting

Which CVE IDs does GHSA-974q-4vvr-vg9c cover?

GHSA-974q-4vvr-vg9c covers the following CVE IDs: CVE-2023-2998. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-974q-4vvr-vg9c?

GHSA-974q-4vvr-vg9c has a CVSS v3 base score of 6.0, published by GitHub Security Advisories.

Which products are affected by GHSA-974q-4vvr-vg9c?

GHSA-974q-4vvr-vg9c affects 1 product, including: composer/thorsten/phpmyfaq:\u003c 3.1.14.

GHSA-974q-4vvr-vg9cMediumCVSS 6.0

thorsten/phpmyfaq vulnerable to cross-site scripting

Vendor

GitHub Security Advisories

Published

May 31, 2023

Last Modified

November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-2998 →

📋 Description

In thorsten/phpmyfaq prior to 3.1.14, when admins create a FAQ News, they can pass xss to the "text of the record" section.

🎯 Affected products1

composer/thorsten/phpmyfaq:< 3.1.14

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-2998
https://github.com/thorsten/phpmyfaq/commit/c120070a66e6c497c328d3b6b067eebcd8ea8493
https://huntr.dev/bounties/8282d78e-f399-4bf4-8403-f39103a31e78
https://github.com/advisories/GHSA-974q-4vvr-vg9c