The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.x
When using Microsoft Internet Explorer 6 or 7 phpMyFAQ doesn't sanitize a GET variable in the search page correctly. With a properly crafted URL it is f.e. possible to inject HTML code into the output of the error message, which could result in the leakage of domain cookies (f.e. session identifiers).
The phpMyFAQ Team has released new phpMyFAQ versions 2.0.17 and 2.5.2 which fix the vulnerability. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
There's no workaround except installing phpMyFAQ 2.0.17 or 2.5.2.