Vulnerability Database

319,703

Total vulnerabilities in the database

CVE-2025-68951

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.

  • Published: Dec 29, 2025
  • Updated: Dec 30, 2025
  • CVE: CVE-2025-68951
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.4
  • AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
Composer icon phpmyfaq / phpmyfaq 4.0.14 4.0.16
Composer icon phpmyfaq / phpmyfaq 4.1.0-rc 4.1.0-rc.x