CVE-2022-40292

CVE-2022-40292 affects PHP Point of Sale 19.0 by PHP Point of Sale, LLC. The vulnerability enables unauthenticated user enumeration by querying an unsecured endpoint to retrieve information about accounts, constituting an information disclosure issue. The NVD entry and related records describe th...

CVE-2022-40291

The CVE-2022-40291 issue affects PHP Point of Sale version 19.0, where a Cross-Site Request Forgery (CSRF) weakness can coerce users into deleting their accounts or, rarely, hijacking accounts and creating additional admin accounts. Root cause: CSRF vulnerability enabling unauthorized state-chang...

CVE-2022-40295

The CVE-2022-40295 entry concerns PHP Point of Sale v19.0, where an authenticated information disclosure allows administrators to view unsalted user passwords, enabling offline attacks to recover plaintext passwords. The vulnerability is described consistently across NVD/CVE records and related s...

CVE-2022-40289

PHP Point of Sale (version 19.0) is affected by an authenticated Stored Cross-Site Scripting (XSS) in the upload/download functionality. The underlying issue allows an attacker to escalate privileges or compromise accounts of users who observe the targeted files. The reports consistently describe...

CVE-2022-40290

CVE-2022-40290 affects PHP Point of Sale (POS) version 19.0, with an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation feature. The underlying issue allows an attacker to craft an unsafe link that could compromise users. Public details consistently descr...

CVE-2022-40287

The CVE-2022-40287 entry refers to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in PHP Point of Sale, version 19.0, within the messaging functionality. The available connected documents confirm the vulnerability allows privilege escalation or compromise of a targeted account v...

CVE-2022-40293

CVE-2022-40293 pertains to a session-fixation vulnerability in PHP Point of Sale, LLC’s PHP Point of Sale 19.0. The issue arises in the application’s session management, enabling an attacker to hijack user accounts. CVSS metrics indicate a CRITICAL impact (CVSS 3.1: 9.8) with high confidentiality...

CVE-2022-40288

The CVE-2022-40288 entry refers to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in PHP Point of Sale, specifically affecting version 19.0 by PHP Point of Sale, LLC. The flaw resides in user profile data fields and can be leveraged to escalate privileges within the application ...

CVE-2022-40294

CVE-2022-40294 concerns a CSV injection in the data export functionality of PHP Point of Sale version 19.0 from PHP Point of Sale, LLC. The vulnerability allows malicious code to be embedded in exported data and triggered in spreadsheet/viewer applications. The connected sources confirm the issue...

CVE-2022-40296

The CVE-2022-40296 entry concerns a Server-Side Request Forgery (SSRF) in PHP Point of Sale version 19.0 (PHP Point of Sale, LLC). The vulnerability allows the backend server to initiate requests to unintended endpoints, potentially including internal/local services, enabling downstream attacks. ...

CVE-2011-3785

CVE-2011-3785 affects PHP Point Of Sale (POS) 10.7. The vulnerability allows remote attackers to disclose sensitive information by directly requesting a PHP file, causing an error message that reveals the installation path (examples include system/scaffolding/views/view.php and similar files). Th...

CVE-2025-41011

CVE-2025-41011 — HTML injection in PHP Point of Sale v19.4 due to insufficient input validation in the /reports/generate/specific_customer endpoint (parameters: start_date_formatted, end_date_formatted). This allows rendering HTML in the victim’s browser. CVSS 4.0: Attack vector NETWORK; attack c...