CVE-2022-40292

CVE-2022-40292: Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Vendor Php Point Of Sale Llc

Product PHP Point of Sale

Weakness CWE-209 · Error message info leak

Published October 31, 2022

Last update May 6, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.

Key dates

02Disclosure timeline

October 31, 2022 CVE published

May 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-40292 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html AskarLabs — CWE-209 write-up Generation of Error Message Containing Sensitive Information

Related vulnerabilities

04Related CVE

CVE-2024-13538 BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute CVE-2024-54366 WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability CVE-2024-13539 AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure CVE-2025-24552 WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability CVE-2024-50512 WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerability