CVE-2022-40288: falha crítica em PHP Point of Sale
Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9epss 0.8%
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
PHP Point of Sale LLC · PHP Point of SaleCVEs relacionadas — PHP Point of Sale
No mesmo produto, das mais perigosas para as menos.
CVE-2022-40294HIGHCSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCEPSS 0.9%CVE-2022-40287CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.EPSS 0.8%CVE-2022-40296CRITICALServer-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.8%CVE-2022-40293CRITICALSession fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.8%CVE-2022-40289CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.EPSS 0.7%CVE-2022-40292MEDIUMUnauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.6%