{"id":"CVE-2022-3608","published":"2022-10-19T00:00:00Z","modified":"2025-05-08T19:14:06Z","title":"Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq","vendor":"thorsten","product":"thorsten/phpmyfaq","tier":"tail","description":{"text":"Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01152,"percentile":0.66911,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/8f0f3635-9d81-4c55-9826-2ba955c3a850","tags":[]},{"url":"https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677","tags":[]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":13.38},{"name":"CVSS severity","points":5.04}]},"vendorSlug":"thorsten","affectedVersions":[{"vendor":"thorsten","product":"thorsten/phpmyfaq","versions":[">= unspecified, < 3.2.0-alpha"]}],"affected":[{"ecosystem":"Packagist","package":"thorsten/phpmyfaq","vulnerableRanges":["<3.2.0-alpha"],"patched":["3.2.0-alpha"],"from":["GHSA-6rj8-9cm9-6gff"],"provenance":"source"},{"ecosystem":"Packagist","package":"phpmyfaq/phpmyfaq","vulnerableRanges":["<3.2.0-alpha"],"patched":["3.2.0-alpha"],"from":["GHSA-6rj8-9cm9-6gff"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7039","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-thorsten-phpmyfaq-cve-2022-3608","children":[{"from":"CVE-2022-3608","to":"CVE-2023-3469","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["phpmyfaq/admin/backup.import.php"],"commits":["https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677","https://github.com/thorsten/phpmyfaq/commit/04a0183c25dd425f4c2bfb5f75b7650b932ae278"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.75,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-5317","published":"2023-09-30","fixed":"3.1.18","kev":false},{"cve":"CVE-2023-5319","published":"2023-09-30","fixed":"3.1.18","kev":false},{"cve":"CVE-2023-5320","published":"2023-09-30","fixed":"3.1.18","kev":false},{"cve":"CVE-2022-3608","published":"2022-10-19","fixed":"3.2.0-alpha","kev":false},{"cve":"CVE-2023-2752","published":"2023-05-17","fixed":"3.2.0-beta","kev":false,"link":{"from":"CVE-2022-3608","to":"CVE-2023-2752","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.2.0-alpha","toFixed":"3.2.0-beta","daysApart":210},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-2753","published":"2023-05-17","fixed":"3.2.0-beta","kev":false,"link":{"from":"CVE-2022-3608","to":"CVE-2023-2753","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:thorsten/phpmyfaq","fromFixed":"3.2.0-alpha","toFixed":"3.2.0-beta","daysApart":210},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2023-3469","published":"2023-06-30","fixed":"3.2.0-beta.2","kev":false}],"package":"Packagist:thorsten/phpmyfaq"}}