[thorsten/phpmyfaq] thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting (XSS) because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-1882
• https://github.com/thorsten/phpmyfaq/commit/49db615c300ae0f87795f20570f6f5bdccb1d2f2
• https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957
• https://github.com/advisories/GHSA-jph3-3j24-pg3j