CVE-2022-40289 — Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges o…
Published: 2022-10-31 · CVSS: 9.0 · CVSS 3.1
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7