Loading...
Skip to main content
GeekWala

CVE-2022-3754 — Vulnerability in thorsten/phpmyfaq — CVE Details

CRITICAL

phpMyFAQ contains Weak Password Requirements

Published October 29, 2022Updated November 8, 2023Source: osv

Summary

phpMyFAQ prior to version 3.1.8 has Weak Password Requirements. Version 3.1.8 introduces an eight-character minimum password length.

Advisory Timeline

  • First published October 29, 2022 (1444 days ago).
  • Last revised November 8, 2023 — 374 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update thorsten/phpmyfaq to 3.1.8 or later
composer require "thorsten/phpmyfaq:^3.1.8"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
thorsten/phpmyfaq
packagist
2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+95 more)3.1.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-3754?
phpMyFAQ contains Weak Password Requirements This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-3754?
CVE-2022-3754 affects thorsten/phpmyfaq. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-3754 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-2rr3-rv49-p42f

Related CVEs

  • CVE-2026-46364
    CRITICAL

    phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

  • CVE-2023-0789
    CRITICAL

    Command Injection in thorsten/phpmyfaq

  • CVE-2026-45010
    CRITICAL

    phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

  • CVE-2023-0311
    CRITICAL

    phpMyFAQ Improper Authentication vulnerability

  • CVE-2026-56737
    HIGH

    phpMyFAQ's two-factor authentication login bypasses the password factor

  • CVE-2026-56396
    HIGH

    phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

  • CVE-2026-35676
    HIGH

    phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

  • CVE-2026-32629
    MEDIUM

    phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies