CVE-2023-0306: 
PHP vulnerability analysis and mitigation

Cross-site Scripting (XSS) - Stored vulnerability was discovered in GitHub repository thorsten/phpmyfaq prior to version 3.1.10. The vulnerability was identified and disclosed on January 15, 2023 (CVE Database).

The vulnerability is a stored cross-site scripting (XSS) issue that occurs due to missing HTML entity conversion in several components of the application. The fix involved adding proper HTML entity encoding using the Strings::htmlentities() function for various user inputs (GitHub Commit).

This stored XSS vulnerability could allow attackers to inject malicious scripts that would be permanently stored on the target servers and executed in the browsers of users who view the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's browser.

The vulnerability has been fixed in version 3.1.10 of phpMyFAQ. The fix implements proper HTML entity encoding using the Strings::htmlentities() function for user input in multiple files including record.show.php and Tags.php (GitHub Commit). Users should upgrade to version 3.1.10 or later to protect against this vulnerability.