Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-569v-kyhm-6bd7
Vulnerability ID VCID-569v-kyhm-6bd7
Aliases CVE-2022-4408
GHSA-rjf6-wj7r-5fj2
Summary Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00224 https://api.first.org/data/v1/epss?cve=CVE-2022-4408
cvssv3.1 5.4 https://github.com/thorsten/phpmyfaq
generic_textual MODERATE https://github.com/thorsten/phpmyfaq
cvssv3 4.3 https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
cvssv3.1 5.4 https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
generic_textual MODERATE https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
ssvc Track* https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
cvssv3 4.3 https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
cvssv3.1 5.4 https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
generic_textual MODERATE https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
ssvc Track* https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-4408
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-4408
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-4408
https://github.com/thorsten/phpmyfaq
https://nvd.nist.gov/vuln/detail/CVE-2022-4408
2ec4ddd4-de22-4f2d-ba92-3382b452bfea https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
e2ea332a2b5e798f2c39203b2489a2dabe831751 https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
GHSA-rjf6-wj7r-5fj2 https://github.com/advisories/GHSA-rjf6-wj7r-5fj2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/thorsten/phpmyfaq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-14T14:44:13Z/ Found at https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-14T14:44:13Z/ Found at https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-4408
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.45294
EPSS Score 0.00224
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:38:50.884739+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/4xxx/CVE-2022-4408.json 38.6.0