CVE-2022-40288

CVE-2022-40288 is a critical authenticated Stored Cross-Site Scripting (XSS) vulnerability affecting phppointofsale php_point_of_sale. An attacker with low privileges can inject malicious scripts into user profile fields, which execute when other users view the compromised profile. This can lead to a complete compromise of accounts and privilege escalation, as indicated by its CVSS score of 9.0 (CRITICAL). While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential impact is severe.