How severe is CVE-2024-22208?

CVE-2024-22208 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.

Is CVE-2024-22208 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22208?

CVE-2024-22208 affects Phpmyfaq. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-22208?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22208 have an EU (EUVD) identifier?

Yes. CVE-2024-22208 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0596.

When was CVE-2024-22208 published?

CVE-2024-22208 was published on 2024-02-05 and last updated on 2026-06-17.

CVE-2024-22208

CVE-2024-22208 is a medium-severity vulnerability in Phpmyfaq with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-0596
Weakness: CWE-863
Affected product: Phpmyfaq
Published: 2024-02-05
Last modified: 2026-06-17

Description

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.

Frequently asked questions

What is CVE-2024-22208?: phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.
How severe is CVE-2024-22208?: CVE-2024-22208 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
Is CVE-2024-22208 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22208?: CVE-2024-22208 affects Phpmyfaq. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-22208?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22208 have an EU (EUVD) identifier?: Yes. CVE-2024-22208 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0596.
When was CVE-2024-22208 published?: CVE-2024-22208 was published on 2024-02-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*

More vulnerabilities in Phpmyfaq

CVE-2023-5865 — Critical (CVSS 9.8): Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CVE-2023-5227 — Critical (CVSS 9.8): Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVE-2023-4006 — Critical (CVSS 9.8): Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
CVE-2023-2429 — Critical (CVSS 9.8): Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVE-2023-0311 — Critical (CVSS 9.8): Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVE-2023-0307 — Critical (CVSS 9.8): Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

All CVEs affecting Phpmyfaq →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →