CVE-2026-111903: phpMyFAQ 4.2.0-alpha to before 4.2.0-beta

Affected technology

phpMyFAQ · 4.2.0-alpha to before 4.2.0-beta
thorsten

Description’s affected range: before 4.2.0-beta

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.