Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-upcw-69mt-wqbb
Vulnerability ID VCID-upcw-69mt-wqbb
Aliases CVE-2024-24574
GHSA-7m8g-fprr-47fx
Summary Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.03118 https://api.first.org/data/v1/epss?cve=CVE-2024-24574
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7m8g-fprr-47fx
cvssv3.1 6.5 https://github.com/thorsten/phpMyFAQ
generic_textual MODERATE https://github.com/thorsten/phpMyFAQ
cvssv3.1 6.5 https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
generic_textual MODERATE https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
ssvc Track https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
cvssv3.1 6.5 https://github.com/thorsten/phpMyFAQ/pull/2827
generic_textual MODERATE https://github.com/thorsten/phpMyFAQ/pull/2827
ssvc Track https://github.com/thorsten/phpMyFAQ/pull/2827
cvssv3.1 6.5 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
cvssv3.1_qr MODERATE https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
generic_textual MODERATE https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
ssvc Track https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2024-24574
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-24574
cvssv3.1 6.5 https://www.phpmyfaq.de/security/advisory-2024-02-05
generic_textual MODERATE https://www.phpmyfaq.de/security/advisory-2024-02-05
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-24574
https://github.com/thorsten/phpMyFAQ
https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
https://github.com/thorsten/phpMyFAQ/pull/2827
https://www.phpmyfaq.de/security/advisory-2024-02-05
CVE-2024-24574 https://nvd.nist.gov/vuln/detail/CVE-2024-24574
GHSA-7m8g-fprr-47fx https://github.com/advisories/GHSA-7m8g-fprr-47fx
GHSA-7m8g-fprr-47fx https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://github.com/thorsten/phpMyFAQ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-07T16:38:54Z/ Found at https://github.com/thorsten/phpMyFAQ/commit/5479b4a4603cce71aa7eb4437f1c201153a1f1f5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://github.com/thorsten/phpMyFAQ/pull/2827
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-07T16:38:54Z/ Found at https://github.com/thorsten/phpMyFAQ/pull/2827
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-07T16:38:54Z/ Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-24574
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://www.phpmyfaq.de/security/advisory-2024-02-05
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.87064
EPSS Score 0.03118
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:03:12.435156+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/phpmyfaq/phpmyfaq/CVE-2024-24574.yml 38.6.0