CVE-2022-40289

9.0 criticalEPSS 0.7%

Critical (9.0) in phppointofsale php point of sale. EPSS 0.7% chance of exploitation in the next 30 days.

The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.

Severity

CVSS 3.1

9.0 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phppointofsale:php_point_of_sale

References

https://www.themissinglink.com.au/security-advisories/cve-2022-40289
https://www.themissinglink.com.au/security-advisories/cve-2022-40289

Check your stack JSON