CVE-2022-40294: fallo de gravedad alta en PHP Point of Sale
CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.9%
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
PHP Point of Sale LLC · PHP Point of SaleCVEs relacionadas — PHP Point of Sale
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-40287CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.EPSS 0.8%CVE-2022-40296CRITICALServer-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.8%CVE-2022-40293CRITICALSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.8%CVE-2022-40288CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionalityEPSS 0.8%CVE-2022-40289CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.EPSS 0.7%CVE-2022-40292MEDIUMUnauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.6%