Vulnerability Description
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpmyfaq | Phpmyfaq | >= 4.0.14, < 4.0.16 |
Related Weaknesses (CWE)
References
- https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6Patch
- https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363Patch
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vcVendor Advisory
FAQ
What is CVE-2025-68951?
CVE-2025-68951 is a vulnerability with a CVSS score of 5.4 (MEDIUM). phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administ...
How severe is CVE-2025-68951?
CVE-2025-68951 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-68951?
Check the references section above for vendor advisories and patch information. Affected products include: Phpmyfaq Phpmyfaq.