CVE-2022-40288 — Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality

CVE-2022-40288

Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality PUBLISHED

Description (CNA)

The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.

Affected (CNA)

Vendor / product	Versions
PHP Point of Sale LLC / PHP Point of Sale	affected 0

CWE

CWE-79

References

https://www.themissinglink.com.au/security-advisories/cve-2022-40288

ADP enrichment

CVE

No English description supplied.

https://www.themissinglink.com.au/security-advisories/cve-2022-40288

CISA-ADP

No English description supplied.

No references supplied.