Vulnerabilities

CVE-2026-86431 is a cross-site scripting vulnerability in the PHP Markdown rendering library league/commonmark (versions 2.7.0 through 2.9.0) in which the AttributesExtension's event-handler and unsafe-link filtering can be bypassed by prefixing an attribute name with a single U+000C form feed byte, which PHP's trim() does not strip, so the attribute is written verbatim into the rendered HTML where browsers treat it as a genuine event handler. It is triggered whenever a server processes untrusted Markdown with the AttributesExtension enabled; the same trick also defeats the allow_unsafe_links check, letting javascript: URIs pass through href/src attributes. An attacker who can submit Markdown therefore gains arbitrary script execution in the browser of any user viewing the rendered page, which can lead to session theft or unauthorized actions in the hosting application. Anyone running a PHP application that renders user-supplied Markdown with league/commonmark versions 2.7.0 or newer but below 2.9.1 and the AttributesExtension enabled is affected. A public proof-of-concept and security advisory (GHSA-f8fg-pg57-v4j8) exist, but there is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS estimates only about a 0.2% chance of exploitation within 30 days.

Do: Upgrade league/commonmark to version 2.9.1 or later, which restores correct attribute filtering. Until patched, disable the AttributesExtension for untrusted Markdown, or strip control characters (notably U+000C form feed) from user-supplied Markdown attribute names and validate href/src values to block javascript: URIs; audit whether your application registers AttributesExtension on user-provided input.

phpMyFAQ before 4.1.7 improperly restricts excessive authentication attempts (CWE-307): the two-factor authentication failure counter is scoped to the session and is reset every time the user successfully re-authenticates with their password. An attacker who already possesses a valid password can therefore bypass the five-attempt limit by repeatedly opening a fresh session and re-submitting the password before each TOTP guess, resetting the counter each time. This enables unbounded guessing of TOTP codes until one is accepted, defeating the second factor and giving the attacker full access to the protected account. Only phpMyFAQ deployments running versions prior to 4.1.7 with TOTP-based two-factor authentication enabled are affected, and the attack requires network access to the login endpoint plus valid user credentials (CVSS 4.0 9.1 Critical, vector AV:N/AC:H/AT:P). There is one public advisory/PoC reference (GHSA-f98m-hcjv-7rp9) but no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS is 0.3% (26th percentile).

Do: Upgrade to phpMyFAQ 4.1.7 or later. Until patched, apply rate limiting or lockouts to the login/2FA endpoints at a reverse proxy or WAF, review 2FA failure logs for repeated failures from a single source, and prioritize accounts with potentially compromised passwords, since exploitation requires a valid password.

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature() reads a URL out of that certificate's Authority Information Access (AIA) extension and connects to it. Attacker who supplies certificate fully controls host, port, and path of that connection. URL fetching is enabled by default, and no destination is blocked. An unauthenticated attacker can therefore make a validating server open connections to internal hosts and ports it should never reach, for example loopback 127.0.0.1, cloud metadata address 169.254.169.254, and internal-only services. This is a server-side request forgery (SSRF) caused by an insecure default. This vulnerability is fixed in 1.0.30, 2.0.55, and 3.0.54.

Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.