Phppointofsale Php_point_of_sale
12 CVEs affecting Phppointofsale Php_point_of_sale. Latest disclosed: 2026-04-21. Critical: 5, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40296 | Critical | 9.8 | 2022-10-31 | The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially includ… |
CVE-2022-40293 | Critical | 9.8 | 2022-10-31 | The application was vulnerable to a session fixation that could be used hijack accounts. |
CVE-2022-40289 | Critical | 9.0 | 2022-10-31 | The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to esc… |
CVE-2022-40288 | Critical | 9.0 | 2022-10-31 | The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate pri… |
CVE-2022-40287 | Critical | 9.0 | 2022-10-31 | The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privileg… |
CVE-2022-40294 | High | 8.8 | 2022-10-31 | The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then t… |
CVE-2022-40291 | High | 8.8 | 2022-10-31 | The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site… |
CVE-2025-41011 | Medium | 6.1 | 2026-04-21 | HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper v… |
CVE-2022-40290 | Medium | 6.1 | 2022-10-31 | The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing atta… |
CVE-2022-40292 | Medium | 5.3 | 2022-10-31 | The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the syst… |
CVE-2022-40295 | Medium | 4.9 | 2022-10-31 | The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the com… |
CVE-2011-3785 | | 2011-09-24 | PHP Point Of Sale (POS) 10.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path i… |