{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T15:03:15.139","vulnerabilities":[{"cve":{"id":"CVE-2026-34974","sourceIdentifier":"security-advisories@github.com","published":"2026-04-02T15:16:51.903","lastModified":"2026-07-24T21:10:00.143","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML entity encoding in javascript: URLs within SVG <a href> attributes. Any user with edit_faq permission can upload a malicious SVG that executes arbitrary JavaScript when viewed, enabling privilege escalation from editor to full admin takeover. This issue has been patched in version 4.1.1."},{"lang":"es","value":"phpMyFAQ es una aplicación web de preguntas frecuentes de código abierto. Antes de la versión 4.1.1, el saneador de SVG basado en expresiones regulares en phpMyFAQ (SvgSanitizer.php) puede ser eludido utilizando codificación de entidades HTML en URLs de tipo javascript: dentro de atributos <a href> de SVG. Cualquier usuario con permiso edit_faq puede subir un SVG malicioso que ejecuta JavaScript arbitrario al ser visualizado, permitiendo la escalada de privilegios de editor a una toma de control total de administrador. Este problema ha sido parcheado en la versión 4.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-02T16:16:00.518178Z","id":"CVE-2026-34974","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.1","matchCriteriaId":"407BB5BA-44EA-49EB-8072-4ACD67864598"}]}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}