Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ztw9-5sne-p3e9
Vulnerability ID VCID-ztw9-5sne-p3e9
Aliases CVE-2022-4409
GHSA-wpgc-5cr5-h9gg
Summary Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-311 Missing Encryption of Sensitive Data
CWE-319 Cleartext Transmission of Sensitive Information
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2022-4409
cvssv3.1 7.5 https://github.com/thorsten/phpmyfaq
generic_textual HIGH https://github.com/thorsten/phpmyfaq
cvssv3 6.3 https://github.com/thorsten/phpmyfaq/commit/8b47f38
cvssv3.1 7.5 https://github.com/thorsten/phpmyfaq/commit/8b47f38
generic_textual HIGH https://github.com/thorsten/phpmyfaq/commit/8b47f38
ssvc Track https://github.com/thorsten/phpmyfaq/commit/8b47f38
cvssv3.1 7.5 https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
generic_textual HIGH https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
cvssv3 6.3 https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
cvssv3.1 7.5 https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
generic_textual HIGH https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
ssvc Track https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-4409
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-4409
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-4409
https://github.com/thorsten/phpmyfaq
https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
https://nvd.nist.gov/vuln/detail/CVE-2022-4409
5915ed4c-5fe2-42e7-8fac-5dd0d032727c https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
8b47f38 https://github.com/thorsten/phpmyfaq/commit/8b47f38
GHSA-wpgc-5cr5-h9gg https://github.com/advisories/GHSA-wpgc-5cr5-h9gg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpmyfaq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:43:47Z/ Found at https://github.com/thorsten/phpmyfaq/commit/8b47f38
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/thorsten/phpMyFAQ/commit/c16cc2bbe2687f75aa1204b804483091fae43cba
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:43:47Z/ Found at https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-4409
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37
EPSS Score 0.00162
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:38:53.146924+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/4xxx/CVE-2022-4409.json 38.6.0