[thorsten/phpmyfaq] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-1758
• https://github.com/thorsten/phpmyfaq/commit/f3380f46c464d1bc6f3ded29213c79be0de8fc57
• https://huntr.dev/bounties/0854328e-eb00-41a3-9573-8da8f00e369c
• https://github.com/advisories/GHSA-3j93-7rf7-p7m6