CVE-2024-55889: phpmyfaq
Vulnerability summary
CVE-2024-55889 is a high (CVSS 7.2) vulnerability in phpmyfaq. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.2% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-12-2024PublishedVulnerability first disclosed.
- 13-12-2024Last modifiedVulnerability information updated.
Description
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
2.19%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.19% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundPhpmyfaq
Maturity: poc
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
Maturity: poc
Weaknesses
CWE · root causeAffected systems
2 vendors · 2 products
References
2 links- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvcX Refsource CONFIRMExploitVendor Advisory