CVE-2022-46888

Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php.

• CWE-79
• CWE-79

• https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33Release Notes, Third Party Advisory
• https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilitiesExploit, Third Party Advisory
• https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33Release Notes, Third Party Advisory
• https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilitiesExploit, Third Party Advisory

Published

Jan 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46882A use-after-free in WebGL extensions could have led to a pot…9.8
• CVE-2022-46883Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew M…8.8
• CVE-2022-46884A potential use-after-free vulnerability existed in SVG Imag…8.8
• CVE-2022-46885Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozi…8.8
• CVE-2022-46886There exists an open redirect within the response list updat…6.1
• CVE-2022-46887Multiple SQL injection vulnerabilities in NexusPHP before 1.…9.8
• CVE-2022-46889A persistent cross-site scripting (XSS) vulnerability in Nex…5.4
• CVE-2022-4689Improper Access Control in GitHub repository usememos/memos …8.8
• CVE-2022-46890Weak access control in NexusPHP before 1.7.33 allows a remot…4.3
• CVE-2022-46891An issue was discovered in the Arm Mali GPU Kernel Driver. T…8.8
• CVE-2022-46892In Ampere AltraMax and Ampere Altra before 2.10c, improper a…9.8
• CVE-2022-46897An issue was discovered in Insyde InsydeH2O with kernel 5.0 …5.3