CVE-2025-68951: 
PHP vulnerability analysis and mitigation

CVE-2025-68951 is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ, an open-source FAQ web application. It affects versions 4.0.14 and 4.0.15 (including 4.1.0-RC), allowing an unauthenticated attacker to inject arbitrary JavaScript into an administrator's browser by registering a user account with a malicious display name containing HTML entities. The vulnerability was disclosed on December 29, 2025, with a patch released in version 4.0.16. It carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, or 5.4 (Moderate) per the GitHub Advisory (GitHub Advisory).

The root cause is a two-stage vulnerability chain classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). First, the attacker-supplied display_name field is stored in the database as HTML entities (e.g., <img src=x onerror=alert(1)>). Second, phpmyfaq/src/phpMyFAQ/User/UserData.php decodes the stored value using PHP's html_entity_decode() for backward compatibility, and the decoded output is then rendered unescaped in the Twig template via {{ user.display_name|raw }} in phpmyfaq/assets/templates/admin/user/users.twig and user-list.twig. This chain converts a safely-stored entity-encoded string into executable HTML/JavaScript at render time. Exploitation requires only that user registration is enabled (security.enableRegistration = true) and that an administrator views the admin user list page (GitHub Advisory, Patch Commit 1).

Successful exploitation allows arbitrary JavaScript execution in the context of an authenticated administrator's browser session. This can lead to admin session hijacking (depending on cookie flags), CSRF token exfiltration enabling unauthorized privileged actions, UI redress or phishing within the admin panel, and potential modification of FAQ content. No availability impact is expected, but confidentiality and integrity of the admin session and application data are at risk (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (9th percentile), indicating a low near-term exploitation probability. However, the attack requires no authentication — only that user registration is enabled — making it accessible to any external attacker who can trigger an administrator to view the user list (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible phpMyFAQ instance running version 4.0.14 or 4.0.15 (or 4.1.0-RC). Confirm that user self-registration is enabled by navigating to the registration page (typically /register or similar).
2. Craft malicious payload: Prepare an HTML entity-encoded XSS payload for the display name field, such as <img src=x onerror=alert(document.cookie)> (which will be stored as HTML entities in the database).
3. Register malicious account: Submit the registration form with the crafted payload as the "Display Name" / "Real Name" field. No authentication is required for this step.
4. Wait for admin interaction: The payload is now stored in the database. When an administrator navigates to the admin user list page (e.g., http://[target]/admin/user/list), the server decodes the HTML entities via html_entity_decode() and renders the result unescaped using Twig's |raw filter.
5. Achieve JavaScript execution: The decoded payload executes as JavaScript in the administrator's browser, enabling session cookie theft, CSRF token exfiltration, or other privileged actions within the admin context (GitHub Advisory).

• Logs: Web server access logs showing POST requests to the phpMyFAQ registration endpoint from unexpected or anonymous sources with unusually long or encoded display_name / realname parameters; admin access logs showing visits to /admin/user/list or /admin/user/ shortly after suspicious registrations.
• Database: User records in the phpMyFAQ user table where the display_name column contains HTML entity sequences such as <, >, &, or patterns resembling encoded script/img tags (e.g., <img, <script, onerror=, onload=).
• Network: Outbound HTTP requests from the administrator's browser to unexpected external hosts (e.g., attacker-controlled servers) immediately after viewing the admin user list, which may indicate cookie or token exfiltration.
• Application Behavior: Unexpected JavaScript alerts, redirects, or UI anomalies observed by administrators when viewing the user management pages.

Upgrade phpMyFAQ to version 4.0.16 or later, which removes the unsafe |raw Twig filter from users.twig and user-list.twig, replacing {{ user.display_name|raw }} with {{ user.display_name }} to enable automatic escaping (Patch Commit 1, Patch Commit 2). If immediate patching is not possible, disable user self-registration (security.enableRegistration = false) to prevent unauthenticated payload injection. Additionally, implementing a strict Content Security Policy (CSP) header can reduce the impact of any XSS execution. Administrators should review existing user registrations for suspicious display names containing HTML entity patterns.