Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2022-3765: phpMyFAQ can run attacker code on visitors
CVE-2022-3765 · published 4 years ago
Summary
The phpMyFAQ web application lets someone place harmful scripts in FAQ entries that are stored on the server. When other users view those entries, the scripts execute in their browsers, potentially stealing data or hijacking sessions. Upgrade to version 3.1.8 or later to stop this behavior.
What to do
- Update thorsten phpmyfaq to version 3.1.8.
- Update phpmyfaq phpmyfaq to version 3.1.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | thorsten | phpmyfaq |
< 3.1.8 Fix: upgrade to 3.1.8
|
| – | phpmyfaq | phpmyfaq |
< 3.1.8 cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
References
- https://github.com/advisories/GHSA-wr74-2v66-57pp
- https://huntr.dev/bounties/613143a1-8e51-449a-b214-12458308835d URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3765.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3765 Vendor Advisory
- https://github.com/thorsten/phpmyfaq/commit/372428d02a08e90b3a253ba5c506cda84581... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.2
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Oct 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta