What is CVE-2022-40294?

CVE-2022-40294 is a high-severity vulnerability in Phppointofsale Php_point_of_sale, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 8.8/10. Published 2022-10-31.

How severe is CVE-2022-40294?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Phppointofsale Php_point_of_sale

CVE-2022-40294

The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.

EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Phppointofsale Php_point_of_sale — versions 19.0
Php Point Of Sale Llc — versions 19.0

Weakness classification (CWE)

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File

References

vdp@themissinglink.com.au (Third Party Advisory)

Frequently asked questions

What is CVE-2022-40294?: CVE-2022-40294 is a high-severity vulnerability in Phppointofsale Php_point_of_sale, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 8.8/10. Published 2022-10-31.
How severe is CVE-2022-40294?: High severity. CVSS v3 base score is 8.8 out of 10.