CVE-2025-68951 Details
Description
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
A stored cross-site scripting vulnerability has been identified in phpMyFAQ versions 4.0.14 and 4.0.15. This vulnerability allows an attacker to execute arbitrary JavaScript in the browser of an administrator. The issue arises when a user is registered with a display name that includes HTML entities. When an administrator accesses the user list, the payload is decoded on the server and rendered without proper escaping, leading to script execution in the context of the admin. phpMyFAQ version 4.0.16 has addressed this vulnerability.
Users can upgrade to phpMyFAQ version 4.0.16 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpmyfaq phpmyfaq | >= 4.0.14, < 4.0.16 4.1.0 rc |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Dec 29, 2025 | New CVE Received | [email protected] |