What’s Vulnerable › Vulnerabilities

CVE-2022-40295: Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-31 · updated 2026-06-17
• Weakness: CWE-916

Description

The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.

Affected products

• PHP Point of Sale LLC PHP Point of Sale: 19.0

References

• https://www.themissinglink.com.au/security-advisories/cve-2022-40295
• https://www.themissinglink.com.au/security-advisories/cve-2022-40295

Get alerted when CVE-2022-40295 or the next vulnerability affects your stack