CVE-2024-27300

Summary

CVE-2024-27300 is a stored XSS vulnerability affecting the phpMyFAQ open-source FAQ application for PHP 8.1 and above. The issue lies in the ineffectiveness of PHP's `FILTER_VALIDATE_EMAIL` function, which only checks the email format but not the content. This weakness allows an attacker to inject malicious JavaScript into the `email` field of the user control panel page, potentially executing malicious code within another user's phpMyFAQ session. This vulnerability has been remedied in version 3.2.6.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.