CVE-2022-3754

CRITICAL

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.3%
Percentile69th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-521: CWE-521
Related Attack Patterns (CAPEC)
CAPEC-16 Dictionary-based Password Attack
via CWE-521
CAPEC-55 Rainbow Table Password Cracking
via CWE-521
CAPEC-70 Try Common or Default Usernames and Passwords
via CWE-521
CAPEC-509 Kerberoasting
via CWE-521
CAPEC-561 Windows Admin Shares with Stolen Credentials
via CWE-521
Show all 9

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The phpMyFAQ application prior to version 3.1.8 hosted on GitHub repository thorsten/phpmyfaq has weak password requirements, which can be exploited by attackers to gain unauthorized access.

BSID: BS-2022-GLOBAL-332317-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-3754?
The phpMyFAQ application prior to version 3.1.8 hosted on GitHub repository thorsten/phpmyfaq has weak password requirements, which can be exploited by attackers to gain unauthorized access.
What is the CVSS score for CVE-2022-3754?
CVE-2022-3754 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2022-3754 actively exploited?
No confirmed active exploitation of CVE-2022-3754 as of 2026-05-30.
How do I remediate CVE-2022-3754?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-3754?
CVE-2022-3754 affects Phpmyfaq Phpmyfaq.
Vulnerability Details
CVE IDCVE-2022-3754
BSIDBS-2022-GLOBAL-332317-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-10-29
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-521
SourceNVD
Official Description

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the weak password requirements to create an account with a simple or easily guessable password, allowing unauthorized access to the application and potentially sensitive data.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Phpmyfaq Phpmyfaq < 3.1.8
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1447 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashefd98e3013e9fda5e5e5d3b67f9d2c1feaf9ebde20f1803d891ad81f0fe68da89d8405724a88e91dbf5551c230666fae3b81f36779412a2d3ac2abbb0e6d7dfb
Related CVEs affecting Phpmyfaq
CVE-2023-0311 9.8 Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. CVE-2023-0788 9.8 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. CVE-2017-11187 9.8 phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try... CVE-2023-0307 9.8 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. CVE-2023-0789 9.8 Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
View all Phpmyfaq CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →