{"id":"CVE-2022-38621","aliases":["EUVD-2022-41198","GHSA-jhv5-8vgm-f4p5"],"status":"published","title":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit...","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.26333,"percentile":0.9803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-09-16T18:36:25Z","modified":"2026-10-28T02:31:13Z","products":[{"vendor":"doufox","product":"doufox"}],"references":[{"url":"https://github.com/Doufox/Doufox/issues/7","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38621","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jhv5-8vgm-f4p5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38621.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-38621","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2022-09-16T18:36:25Z","modified":"2024-08-03T11:02:14.431Z","updated_at":"2026-11-02T14:34:37.272373Z"}],"euvd":[{"id":"EUVD-2022-41198","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2022-09-16T18:36:25Z","modified":"2024-08-03T11:02:14Z","updated_at":"2026-11-03T03:25:21.94292Z"}],"ghsa":[{"id":"GHSA-jhv5-8vgm-f4p5","title":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit...","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2022-09-17T00:00:31Z","modified":"2023-01-30T05:03:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:46:52.374347Z"}],"nvd":[{"id":"CVE-2022-38621","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2022-09-16T19:15:09.98Z","modified":"2026-06-17T04:56:54.907Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-38621","description":"Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2022-09-16T18:36:25Z","modified":"2026-10-28T02:31:13.224915288Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}