CVE-2022-3540

CVE-2022-3540 is a medium-severity vulnerability affecting all versions of hunter2 prior to 2.1.0, where improper handling of auto-completion input allows an authenticated attacker to extract other users' email addresses. The vulnerability has a CVSS score of 6.5, indicating a network-based attack with low complexity, requiring low privileges, and resulting in high confidentiality impact without affecting integrity or availability. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB) and it is not listed in CISA's KEV catalog, the vulnerability has garnered significant community discussion and media coverage, suggesting awareness despite the lack of active exploitation.