phpMyFAQ, Stored XSS, Critical

Listen to this Post

🐢▶️ Listen🚀

How the vulnerability works:

The vulnerability exists in phpMyFAQ’s FAQ creation and update endpoints. When a user submits a FAQ answer, the code applies `FILTER_SANITIZE_SPECIAL_CHARS` (via Filter::filterVar()), which converts `` survives entirely. The sanitized (but actually dangerous) content is stored in the database. Later, when the FAQ is rendered, the Twig template `faq.twig` outputs the answer using `{{ answer|raw }}` and the question with {{ question|raw }}. The `|raw` filter disables auto-escaping, so the injected `