5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68951

CVE-2025-68951: phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68951

CVE-2025-68951:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	>= 4.0.14, < 4.0.16	4.0.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) in the phpMyFAQ admin panel. It's caused by a two-step process. First, when a user is created, their display name is stored in the database. An attacker can use a name that includes an XSS payload encoded as HTML entities. Second, when an administrator views the user list, the application logic triggers the vulnerability. The phpMyFAQ\User\UserData::__construct function is called, which reads the user's display name from the database and decodes it using html_entity_decode. This converts the encoded payload back into raw HTML. Subsequently, the phpMyFAQ\Controller\Admin\UserController::listUsers action renders the user list. Before the patch, the template used the |raw filter in Twig ({{ user.display_name|raw }}), which explicitly disables output escaping. This allows the decoded HTML and JavaScript payload to be rendered in the administrator's browser, leading to XSS. The fix involves removing the |raw filter from the templates, ensuring that the display name is always HTML-escaped.

Vulnerable functions

phpMyFAQ\User\UserData::__construct

src/phpMyFAQ/User/UserData.php

This constructor function is called when loading user data. It decodes the user's display name from the database using `html_entity_decode`. An attacker can register with a display name containing an XSS payload encoded as HTML entities. This function decodes the payload back into raw HTML, which is then passed to the rendering template.

phpMyFAQ\Controller\Admin\UserController::listUsers

src/phpMyFAQ/Controller/Admin/UserController.php

This controller action handles the display of the admin user list. It fetches user data, including the maliciously crafted and decoded `display_name`, and renders the `users.twig` template. This action is the entry point for the vulnerable page and would be present in the stack trace during exploitation, as it orchestrates the process of fetching the tainted data and passing it to the vulnerable template.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.