CVE-2022-40289: Phppointofsale PHP Point Of Sale

Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days.

The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.

Affected products

Published 2022-10-31. Last modified 2026-06-17.