Medium severity · published Feb 5, 2024
CVE-2024-24574
phpMyFAQ vulnerable to stored XSS on attachments filename
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpMyFAQ · thorsten
< 3.2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24574
Patch
https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
Patch
https://github.com/thorsten/phpMyFAQ/pull/2827
Exploit
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
More from phpMyFAQ
9.8
CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
9.8
CVE-2026-46364
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
9.8
CVE-2025-59943
phpMyFAQ duplicate email registration allows multiple accounts with the same email
9.4
CVE-2026-66398
phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
9.1
CVE-2026-45010
phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint