CVE-2022-40288: Phppointofsale PHP Point Of Sale

Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days.

The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.

Affected products

• Phppointofsale PHP Point Of Sale: version 19.0 only

Published 2022-10-31. Last modified 2026-06-17.