CVE-2022-47945Vulnerability
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 2 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More“…ties -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79.145 (Hong Kong), 211.20.144.116 (Taiwan), and 210.242.76.32 (Taiwan).”
-
PHP Cryptomining Campaign: October/November 2025“The loudest campaigns exploit ThinkPHP Framework LFI (CVE-2022-47945), PHP CGI (CVE-2012-1823), and PHP CVE-2024-4577, all of which show steep growth.”
-
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day“ThinkPHP Framework LFI CVE-2022-47945 Attempt”
-
New Exploitation Surge: Attackers Target ThinkPHP and ownCloud Flaws at Scale“CVE-2022-47945 (ThinkPHP LFI) – A local file inclusion vulnerability in ThinkPHP that is not in CISA’s Known Exploited Vulnerabilities (KEV) catalog and has a low EPSS score (7%), yet GreyNoise has observed a surge in exploitation attempts.”
Indicators reported together
named in the same reports- 119.13.79[.]145in 1 report
- 210.242.76[.]32in 1 report
- 211.20.144[.]116in 1 report
- blueskyweb[.]xyzin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2024-4577, CVE-2019-9082, CVE-2024-40766, CVE-2023-27532, CVE-2012-1823, CVE-2020-3259, CVE-2023-49103, CVE-2021-41773, CVE-2026-107186, CVE-2026-107187, CVE-2026-107188, CVE-2023-20269, CVE-2024-40711, CVE-2026-113380, CVE-2026-65162, CVE-2026-114509
Thanks — we review every report.