CVEvulnerability

CVE-2022-40295

4.9 MEDIUM Published 2022-10-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-311, CWE-916

Description

The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.

Affected configurations

• phppointofsale php point of sale 19.0

Related

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References