CVE-2026-46361 — Cross-Site Scripting (XSS)

title: CVE-2026-46361 - phpMyFAQ Stored XSS in Search
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
  Detects potential exploitation of CVE-2026-46361 by looking for search queries containing JavaScript payloads within the URI. This rule specifically targets the search functionality of phpMyFAQ and looks for common XSS indicators within the query parameter, which is known to be vulnerable in versions prior to 4.1.2.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-46361/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/search.php'
      cs-uri-query|contains:
          - 'query=' 
      cs-uri-query|contains:
          - '<script>alert(' 
  selection_base:
      cs-uri|contains:
          - '/search.php'
  selection_indicators:
      cs-uri-query|contains:
          - 'query=' 
      cs-uri-query|contains:
          - '<script>alert(' 
  condition: selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse