CVE-2024-28108

Summary

CVE-2024-28108 is a vulnerability affecting the phpMyFAQ open-source FAQ application, version 3.2.5 and below. This issue arises due to insufficient validation of the `contentLink` parameter, allowing unauthenticated users to inject HTML code into pages. Moreover, for this vulnerability to exploit successfully, guest users must be permitted to add new FAQs, and the admin must neglect to screen newly added content. Consequently, other users on the platform might be adversely affected. The vulnerability has been addressed and fixed in version 3.2.6.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.