Medium severity · published Feb 5, 2024
CVE-2024-24574
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpmyfaq · Phpmyfaq
before 3.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24574
Patch
https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
Patch
https://github.com/thorsten/phpMyFAQ/pull/2827
Exploit
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
More from Phpmyfaq
9.8
CVE-2025-59943
phpMyFAQ duplicate email registration allows multiple accounts with the same email
9.8
CVE-2023-5865
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2
9.8
CVE-2023-5227
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8
9.8
CVE-2023-4006
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16
9.8
CVE-2023-2429
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13