CVE-2022-46888

Deeper analysis

NexusPHP versions prior to 1.7.33 contain multiple reflected cross-site scripting flaws tracked as CVE-2022-46888. The issues reside in several application endpoints and permit injection of arbitrary script or HTML through the secret parameter on login.php, the q parameter on user-ban-log.php, the query parameter on log.php, the text parameter on moresmiles.php, the q parameter on myhr.php, and the id parameter on viewrequests.php. The vulnerabilities are rated CVSS 6.1 under CWE-79 and require no authentication.

An unauthenticated remote attacker can exploit the flaws by crafting a malicious link or request that reflects attacker-controlled content back to a victim user. Successful exploitation results in execution of arbitrary JavaScript in the context of the victim’s session, enabling theft of cookies, session hijacking, or other client-side actions within the NexusPHP application.

The official fix is included in the NexusPHP 1.7.33 release published on GitHub. A security review by SureCloud also documents these and related issues, confirming that upgrading to the patched version addresses the reflected XSS vectors. The EPSS score reached a peak of 0.1837 and currently sits at 0.1452, indicating moderate and sustained exploitation interest after disclosure.