How severe is CVE-2022-3774?

CVE-2022-3774 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.

Is CVE-2022-3774 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-3774?

CVE-2022-3774 affects Train Scheduler App Project Train Scheduler App. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-3774?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-3774 published?

CVE-2022-3774 was published on 2022-10-31 and last updated on 2026-06-17.

CVE-2022-3774

CVE-2022-3774 is a medium-severity vulnerability in Train Scheduler App Project Train Scheduler App with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-99.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 1% (63rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-99
Affected product: Train Scheduler App Project Train Scheduler App
Published: 2022-10-31
Last modified: 2026-06-17

Description

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.

Frequently asked questions

What is CVE-2022-3774?: A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.
How severe is CVE-2022-3774?: CVE-2022-3774 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
Is CVE-2022-3774 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-3774?: CVE-2022-3774 affects Train Scheduler App Project Train Scheduler App. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-3774?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-3774 published?: CVE-2022-3774 was published on 2022-10-31 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:train_scheduler_app_project:train_scheduler_app:1.0:*:*:*:*:*:*:*

More vulnerabilities in Train Scheduler App Project Train Scheduler App

CVE-2022-43079 — Medium (CVSS 6.1): A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to…
CVE-2022-42992 — Medium (CVSS 5.4): Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute…

All CVEs affecting Train Scheduler App Project Train Scheduler App →

Other CWE-99 vulnerabilities

CVE-2025-43491 — Critical (CVSS 9.8): A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the…
CVE-2017-5159 — Critical (CVSS 9.8): An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an…
CVE-2025-2410 — Critical (CVSS 9.1): Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if…
CVE-2025-0756 — Critical (CVSS 9.1): Overview The product receives input from an upstream component, but it does not restrict or incorrectly…
CVE-2024-57971 — Critical (CVSS 9.1): DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that…
CVE-2024-5706 — High (CVSS 8.8): The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input…

Browse all CWE-99 vulnerabilities →