CVE-2022-40293

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The application was vulnerable to a session fixation that could be used hijack accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

VendorProductVersions
PHP Point of Sale LLCPHP Point of Sale0

References

Timeline

Published
Oct 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-402948.8The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within expoCVE-2022-402954.9The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which coCVE-2022-402969.8The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, CVE-2022-402977.8UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, CVE-2022-402988.8Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found CVE-2022-402997.8In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other usCVE-2022-40308.1The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which cCVE-2022-403009.8Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 befCVE-2022-403026.5An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length CVE-2022-403037.5An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, CVE-2022-403047.8An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading tCVE-2022-403059.8A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network res
CVE-2022-40293: Critical severity, CVSS 9.8 | Vulnix