Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-1t5n-wup2-4uav
Vulnerability ID VCID-1t5n-wup2-4uav
Aliases CVE-2022-4409
GHSA-wpgc-5cr5-h9gg
Summary phpMyFAQ has insecure HTTP cookies phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-311 Missing Encryption of Sensitive Data
CWE-319 Cleartext Transmission of Sensitive Information
CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00154 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
epss 0.00154 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-wpgc-5cr5-h9gg
cvssv3.1 7.5 https://github.com/thorsten/phpmyfaq
generic_textual HIGH https://github.com/thorsten/phpmyfaq
cvssv3 6.3 https://github.com/thorsten/phpmyfaq/commit/8b47f38
cvssv3.1 7.5 https://github.com/thorsten/phpmyfaq/commit/8b47f38
generic_textual HIGH https://github.com/thorsten/phpmyfaq/commit/8b47f38
ssvc Track https://github.com/thorsten/phpmyfaq/commit/8b47f38
cvssv3.1 7.5 https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
generic_textual HIGH https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
cvssv3 6.3 https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
cvssv3.1 7.5 https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
generic_textual HIGH https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
ssvc Track https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-4409
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-4409
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-4409
https://github.com/thorsten/phpmyfaq
https://github.com/thorsten/phpmyfaq/commit/8b47f38
https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
https://nvd.nist.gov/vuln/detail/CVE-2022-4409
GHSA-wpgc-5cr5-h9gg https://github.com/advisories/GHSA-wpgc-5cr5-h9gg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpmyfaq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:43:47Z/ Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:43:47Z/ Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-4409
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.35823
EPSS Score 0.00154
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:47:57.467927+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-wpgc-5cr5-h9gg/GHSA-wpgc-5cr5-h9gg.json 38.6.0