CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-24574: phpMyFAQ vulnerable to stored XSS on attachments filename
6.5
CVSS
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
Classification
CVE ID: CVE-2024-24574
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Problem Types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Affected Products
Vendor: thorsten
Product: phpMyFAQ
Exploit Prediction Scoring System (EPSS)
EPSS Score: 1.78% (probability of being exploited)
EPSS Percentile: 81.87% (scored less or equal to compared to others)
EPSS Date: 2025-06-19 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: poc
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-24574https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
https://github.com/thorsten/phpMyFAQ/pull/2827
https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5