The vulnerability arises from a regex bypass flaw in the Filter::removeAttributes() routine of phpMyFAQ, allowing attackers to embed malicious JavaScript into data that is stored in the database and later rendered in web pages. When an end user views affected content, the injected script executes in their browser, providing client‑side code execution that can harvest session cookies, deface the site, or launch phishing attacks.

Open source FAQ web application phpMyFAQ, produced by thorsten, is affected for every release before version 4.1.1. The flaw is present wherever user supplied content is stored without proper attribute removal.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not documented in the CISA KEV catalog. Exploitation requires an attacker to inject malicious content into a stored field, such as an FAQ entry or comment, which then triggers when any user loads the page. Successful exploitation would grant only client‑side control, not system‑level access.