Wiz
Vulnerability DatabaseCVE-2022-3516

CVE-2022-3516: 
PHP vulnerability analysis and mitigation

Overview

Cross-site Scripting (XSS) - Stored vulnerability was discovered in GitHub repository librenms/librenms prior to version 22.10.0. The vulnerability was assigned CVE-2022-3516 and was related to improper handling of titles in the notifications system (CVE Mitre, NVD).

Technical details

The vulnerability was a stored XSS issue in the notifications system where title values were not properly sanitized before being displayed to users. The issue was present in the notifications.inc.php file where raw title values were directly output without proper HTML encoding (GitHub Commit).

Impact

A successful exploitation of this vulnerability could allow attackers to inject and execute malicious JavaScript code in the context of other users' browsers who view the notifications. This could potentially lead to session hijacking, defacement, or theft of sensitive browser data.

Mitigation and workarounds

The vulnerability was fixed in LibreNMS version 22.10.0 by implementing proper HTML encoding of notification titles using the htmlentities() function. Users should upgrade to version 22.10.0 or later to protect against this vulnerability (GitHub Commit).

Additional resources

Source: This report was generated using AI

Related PHP vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-65346CRITICAL9.1
  • PHPPHP
  • alexusmai/laravel-file-manager
NoNoDec 04, 2025
CVE-2025-66468HIGH7.6
  • PHPPHP
  • aimeos/ai-cms-grapesjs
NoYesDec 02, 2025
CVE-2025-65345MEDIUM6.5
  • PHPPHP
  • alexusmai/laravel-file-manager
NoNoDec 03, 2025
CVE-2025-65657MEDIUM6.5
  • PHPPHP
  • feehi/cms
NoNoDec 02, 2025
CVE-2025-65186MEDIUM6.1
  • PHPPHP
  • getgrav/grav
NoNoDec 02, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo