Live › vulnerability › CVE-2026-111894
Go to dashboardAuthenticated content authors can embed iframes with data:text/html sources in FAQ or news entries, and the sanitizer fails to block them. Viewers' browsers then run attacker JavaScript for phishing or top-frame redirects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 3.2.1 through 4.1.8, or 4.2.0-alpha builds before 4.2.0-beta, where content authors can post FAQ or news entries. Exposure depends on who holds author rights; sites where only trusted staff write content carry less risk. Sites on a fixed version can skip it.
No product ranges from the sources yet.
phpMyFAQ admin panel or composer show phpmyfaq/phpmyfaq (unknown if the sources give a file to read)<iframe with data:text/html in the source4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.
This page as .md · .json · in your agent: get_signal("CVE-2026-111894")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.