Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side (XSS)
On that snippet code of rendering the file attachments from user tables
<?php foreach ($crumbs as $item) : ?>
<tr id="attachment_<?= $item->id ?>" title="<?= $item->thema ?>">
<td><?= $item->id ?></td>
<td><?= $item->filename ?></td>
<td><?= $item->record_lang ?></td>
<td><?= Utils::formatBytes($item->filesize) ?></td>
<td><?= $item->mime_type ?></td>
<td>The data directly rendering with short hand echo without any sanitation first, its recommend to use existing class of Strings::htmlentities on use phpMyFAQ\Strings;
This vulnerability will allow an attacker with a permissions of uploading an attachment to storing the payload of XSS on database specific table faqattachment columns filename.