What’s Vulnerable › Vulnerabilities

CVE-2022-40294: CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-31 · updated 2026-06-17
• Weakness: CWE-1236

Description

The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.

Affected products

• PHP Point of Sale LLC PHP Point of Sale: 19.0

References

• https://www.themissinglink.com.au/security-advisories/cve-2022-40294
• https://www.themissinglink.com.au/security-advisories/cve-2022-40294

Get alerted when CVE-2022-40294 or the next vulnerability affects your stack