CVE-2022-40294CWE-1236

CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC

High · published October 31, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
56.6
In the wild
Unconfirmed
What it is

The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00814 · 56.6th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-10-31T20:09Z
EPSS history
Timeline
  • 31 OCT 20:09Z
    CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC
    cvelistv5