NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

CVE-2025-68951 — phpmyfaq

MEDIUMFix: thorsten/phpMyFAQ@61829e8

CVE-2025-68951 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in thorsten/phpmyfaq. A fix is available for thorsten/phpmyfaq — see the affected versions and patch details below.

phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

Also known asGHSA-jv8r-hv7q-p6vc
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-68951.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs21th percentile — riskier than 21% of all scored CVEsHighest risk
0.00%0.26%0.52%0.78%0.1%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘thorsten/phpmyfaq

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities (e.g., <img ...>). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context.

Details

Root cause is the following chain:

  • User-controlled input stored: attacker-provided display_name (real name) is stored in DB (often as HTML entities, e.g., <img ...>).
  • Decode on read: phpmyfaq/src/phpMyFAQ/User/UserData.php decodes display_name using html_entity_decode(...) (“for backward compatibility”).
  • Unsafe sink: admin user list renders the decoded value unescaped using Twig |raw:
    • phpmyfaq/assets/templates/admin/user/users.twig (users table uses {{ user.display_name|raw }})

As a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list.

Note: This report is about the display_name field + entity-decoding path. It is distinct from previously published issues focused on the email field.

PoC (minimal reproduction)

Preconditions / configuration

  • Registration enabled (security.enableRegistration = true).
  • Attacker does not need admin privileges.
  • Admin must view the admin user list page.

Steps

  1. As an unauthenticated user, open the registration page and create a new account.
  2. Set the display name / real name field to the following entity-encoded payload:
    • <img src=x onerror=alert(1)>
  3. Complete registration.
  4. As an administrator, open the admin user list (example):
    • http://127.0.0.1:8080/admin/user/list
  5. Observe JavaScript execution in the admin’s browser (e.g., alert(1) triggers) and the payload is rendered as an actual <img> element.

Impact

Stored XSS in the admin context can enable:

  • admin session compromise (depending on cookie flags),
  • CSRF token exfiltration and privileged admin actions,
  • UI redress/phishing within the admin panel.

Evidence (what I observed)

  • Stored DB value (entities): &lt;img src=x onerror=alert(1)&gt;
  • Rendered HTML in admin user list: <img src="x" onerror="alert(1)">

Affected versions

Confirmed by code inspection

  • 4.0.14
  • 4.0.15
    • Both contain html_entity_decode for display_name in UserData.php and {{ user.display_name|raw }} in users.twig.

Confirmed by live reproduction

  • 4.1.0-RC (tested on current source checkout)

Environment (tested)

  • Host OS: macOS 15.6.1 (24G90)
  • Web container OS: Debian GNU/Linux 12 (bookworm)
  • PHP: 8.4.5RC1
  • DB: MariaDB 11.6.2
  • phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848

Contact / Credit

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistthorsten/phpmyfaq≥ 4.0.14&&< 4.0.164.0.16composer require thorsten/phpmyfaq:^4.0.16

Affected Products

1 product · 2 configurations
Application
phpmyfaqphpmyfaq
≥ 4.0.14 && < 4.0.16
1 version
4.1.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thorsten/phpmyfaq, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update thorsten/phpmyfaq to 4.0.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-68951 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `&lt;img ...&gt;`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. ### Details Root cause is the following chain: - **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `&lt;img ...&gt;`).
O3 Security · Impact-Aware SCA

Is CVE-2025-68951 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-68951: phpmyfaq XSS — Fixed in 4.0.16