CVE-2022-3766

Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

7.3 HighPublic exploitFix available

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

8.28%Up 7.4 points since Nov 1, 2022

What each source reports

CVE List Score used 7.3

Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Record: CVE-2022-3766
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-7129 7.3

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Record: EUVD-2022-7129
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mg5h-rhjq-6v84 6.1

phpMyFAQ vulnerable to reflected Cross-site Scripting

phpMyFAQ prior to version 3.1.8 is vulnerable to reflected cross-site scripting.

Record: GHSA-mg5h-rhjq-6v84
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 6.1

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Record: CVE-2022-3766
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSV 7.3

Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Record: CVE-2022-3766
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-mg5h-rhjq-6v84 6.1

phpMyFAQ vulnerable to reflected Cross-site Scripting

phpMyFAQ prior to version 3.1.8 is vulnerable to reflected cross-site scripting.

Record: GHSA-mg5h-rhjq-6v84
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`thorsten/phpmyfaq` Packagist	before 3.1.8	3.1.8
`thorsten/phpmyfaq` Packagist	before 3.1.8, plus listed versions 2.10.0-alpha2.8.02.8.0-RC2.8.0-RC22.8.0-RC3 Show 45 moreShow less 2.8.0-RC42.8.0-alpha22.8.0-alpha32.8.0-beta2.8.0-beta22.8.0-beta32.8.12.8.102.8.112.8.122.8.132.8.142.8.152.8.162.8.172.8.182.8.192.8.22.8.202.8.212.8.222.8.232.8.242.8.252.8.262.8.272.8.282.8.292.8.32.8.42.8.52.8.62.8.72.8.82.8.92.9.02.9.0-alpha2.9.0-alpha22.9.0-alpha32.9.0-alpha42.9.0-beta2.9.0-beta22.9.0-rc2.9.0-rc22.9.0-rc3	3.1.8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)	2025-12-02
Nuclei	phpMyFAQ < 3.1.8 - Cross-Site Scripting

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3766 is a high vulnerability (CVSS 7.3) in Phpmyfaq, published October 31, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.28%, the 94th percentile. Fixed in thorsten/phpmyfaq 3.1.8.

References

This page doesn't list everything

Left out here: 49 versions. The JSON record has them.