Vulnerability-Lookup

CVE-2025-68951 (GCVE-0-2025-68951)

Vulnerability from cvelistv5 – Published: 2025-12-29 15:18 – Updated: 2025-12-29 16:13

Title

phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

Summary

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-29 16:13 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/thorsten/phpMyFAQ/security/adv…	x_refsource_CONFIRM
https://github.com/thorsten/phpMyFAQ/commit/61829…	x_refsource_MISC
https://github.com/thorsten/phpMyFAQ/commit/8211d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
thorsten	phpMyFAQ	Affected: >= 4.0.14, < 4.0.16	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68951",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:13:42.626228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:13:54.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phpMyFAQ",
          "vendor": "thorsten",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.14, \u003c 4.0.16"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator\u2019s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-29T15:18:58.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
        },
        {
          "name": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
        },
        {
          "name": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
        }
      ],
      "source": {
        "advisory": "GHSA-jv8r-hv7q-p6vc",
        "discovery": "UNKNOWN"
      },
      "title": "phpMyFAQ has stored XSS in admin \"List of users\" via display_name HTML entity decoding (html_entity_decode) + Twig |raw"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68951",
    "datePublished": "2025-12-29T15:18:58.000Z",
    "dateReserved": "2025-12-26T16:46:17.499Z",
    "dateUpdated": "2025-12-29T16:13:54.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68951",
      "date": "2026-10-03",
      "epss": "0.0028",
      "percentile": "0.18628"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "phpMyFAQ",
                "vendor": "thorsten",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.14, \u003c 4.0.16"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D67FD17-E636-48E3-B76A-F3CB02C62C8A",
                    "versionEndExcluding": "4.0.16",
                    "versionStartIncluding": "4.0.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*",
                    "matchCriteriaId": "C2C7FC83-7A47-4046-8DE0-F0B81BFF2DDD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator\u2019s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue."
          }
        ],
        "id": "CVE-2025-68951",
        "lastModified": "2026-06-17T09:59:53.017",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-68951",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:13:42.626228Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-29T16:15:43.600",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-12-30T15:54:14+00:00",
      "cve": "CVE-2025-68951",
      "id": "CVE-2025-68951",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "phpMyFAQ has stored XSS in admin \"List of users\" via display_name HTML entity decoding (html_entity_decode) + Twig |raw",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68951.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-68951",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-29T16:13:42.626228Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-29T16:13:47.980Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "phpMyFAQ",
              "vendor": "thorsten",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.14, \u003c 4.0.16"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator\u2019s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-29T15:18:58.000Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
            },
            {
              "name": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
            },
            {
              "name": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
            }
          ],
          "source": {
            "advisory": "GHSA-jv8r-hv7q-p6vc",
            "discovery": "UNKNOWN"
          },
          "title": "phpMyFAQ has stored XSS in admin \"List of users\" via display_name HTML entity decoding (html_entity_decode) + Twig |raw"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-68951",
        "datePublished": "2025-12-29T15:18:58.000Z",
        "dateReserved": "2025-12-26T16:46:17.499Z",
        "dateUpdated": "2025-12-29T16:13:54.598Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-68951

Vulnerability from fkie_nvd - Published: 2025-12-29 16:15 - Updated: 2026-06-17 09:59

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370	Patch
security-advisories@github.com	https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87	Patch
security-advisories@github.com	https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc	Vendor Advisory

Impacted products

	Vendor	Product	Version
	phpmyfaq	phpmyfaq	*
	phpmyfaq	phpmyfaq	4.1.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "phpMyFAQ",
          "vendor": "thorsten",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.14, \u003c 4.0.16"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D67FD17-E636-48E3-B76A-F3CB02C62C8A",
              "versionEndExcluding": "4.0.16",
              "versionStartIncluding": "4.0.14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*",
              "matchCriteriaId": "C2C7FC83-7A47-4046-8DE0-F0B81BFF2DDD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator\u2019s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue."
    }
  ],
  "id": "CVE-2025-68951",
  "lastModified": "2026-06-17T09:59:53.017",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68951",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-29T16:13:42.626228Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-29T16:15:43.600",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JV8R-HV7Q-P6VC

Vulnerability from github – Published: 2025-12-29 22:12 – Updated: 2025-12-31 22:13

Summary

phpMyFAQ has Stored XSS in user list via admin-managed display_name

Details

Summary

A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities (e.g., <img ...>). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.

Details

Root cause is the following chain: - User-controlled input stored: attacker-provided display_name (real name) is stored in DB (often as HTML entities, e.g., <img ...>). - Decode on read: phpmyfaq/src/phpMyFAQ/User/UserData.php decodes display_name using html_entity_decode(...) (“for backward compatibility”). - Unsafe sink: admin user list renders the decoded value unescaped using Twig |raw: - phpmyfaq/assets/templates/admin/user/users.twig (users table uses {{ user.display_name|raw }})

As a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.

Note: This report is about the display_name field + entity-decoding path. It is distinct from previously published issues focused on the email field.

PoC (minimal reproduction)

Preconditions / configuration - Registration enabled (security.enableRegistration = true). - Attacker does not need admin privileges. - Admin must view the admin user list page.

Steps 1. As an unauthenticated user, open the registration page and create a new account. 2. Set the display name / real name field to the following entity-encoded payload: - <img src=x onerror=alert(1)> 3. Complete registration. 4. As an administrator, open the admin user list (example): - http://127.0.0.1:8080/admin/user/list 5. Observe JavaScript execution in the admin’s browser (e.g., alert(1) triggers) and the payload is rendered as an actual <img> element.

Impact

Stored XSS in the admin context can enable: - admin session compromise (depending on cookie flags), - CSRF token exfiltration and privileged admin actions, - UI redress/phishing within the admin panel.

Evidence (what I observed)

Stored DB value (entities): <img src=x onerror=alert(1)>
Rendered HTML in admin user list: <img src="x" onerror="alert(1)">

Affected versions

Confirmed by code inspection - 4.0.14 - 4.0.15 - Both contain html_entity_decode for display_name in UserData.php and {{ user.display_name|raw }} in users.twig.

Confirmed by live reproduction - 4.1.0-RC (tested on current source checkout)

Environment (tested)

Host OS: macOS 15.6.1 (24G90)
Web container OS: Debian GNU/Linux 12 (bookworm)
PHP: 8.4.5RC1
DB: MariaDB 11.6.2
phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848

Contact / Credit

Contact: jeongwoolee340@gmail.com

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.14"
            },
            {
              "fixed": "4.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68951"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T22:12:35Z",
    "nvd_published_at": "2025-12-29T16:15:43Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator\u2019s browser by registering a user whose **display name** contains HTML entities (e.g., `\u0026lt;img ...\u0026gt;`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.\n\n### Details\nRoot cause is the following chain:\n- **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `\u0026lt;img ...\u0026gt;`).\n- **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (\u201cfor backward compatibility\u201d).\n- **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`:\n  - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`)\n\nAs a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.\n\nNote: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field.\n\n### PoC (minimal reproduction)\n**Preconditions / configuration**\n- Registration enabled (`security.enableRegistration = true`).\n- Attacker does not need admin privileges.\n- Admin must view the admin user list page.\n\n**Steps**\n1. As an unauthenticated user, open the registration page and create a new account.\n2. Set the **display name / real name** field to the following entity-encoded payload:\n   - `\u0026lt;img src=x onerror=alert(1)\u0026gt;`\n3. Complete registration.\n4. As an administrator, open the admin user list (example):\n   - `http://127.0.0.1:8080/admin/user/list`\n5. Observe JavaScript execution in the admin\u2019s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `\u003cimg\u003e` element.\n\n### Impact\nStored XSS in the admin context can enable:\n- admin session compromise (depending on cookie flags),\n- CSRF token exfiltration and privileged admin actions,\n- UI redress/phishing within the admin panel.\n\n### Evidence (what I observed)\n- Stored DB value (entities):\n  `\u0026lt;img src=x onerror=alert(1)\u0026gt;`\n- Rendered HTML in admin user list:\n  `\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e`\n\n### Affected versions\n**Confirmed by code inspection**\n- 4.0.14\n- 4.0.15\n  - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`.\n\n**Confirmed by live reproduction**\n- 4.1.0-RC (tested on current source checkout)\n\n### Environment (tested)\n- Host OS: macOS 15.6.1 (24G90)\n- Web container OS: Debian GNU/Linux 12 (bookworm)\n- PHP: 8.4.5RC1\n- DB: MariaDB 11.6.2\n- phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848\n\n### Contact / Credit\n- Contact: jeongwoolee340@gmail.com",
  "id": "GHSA-jv8r-hv7q-p6vc",
  "modified": "2025-12-31T22:13:13Z",
  "published": "2025-12-29T22:12:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68951"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ has Stored XSS in user list via admin-managed display_name"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-68951 (GCVE-0-2025-68951)

FKIE_CVE-2025-68951

GHSA-JV8R-HV7Q-P6VC

Summary

Details

PoC (minimal reproduction)

Impact

Evidence (what I observed)

Affected versions

Environment (tested)

Contact / Credit

Tags

Sightings

Nomenclature

Related by attack behaviour