CVE-2022-40295
31.10.2022, 21:15
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.Enginsight
| Vendor | Product | Version |
|---|---|---|
| phppointofsale | php_point_of_sale | 19.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-916 - Use of Password Hash With Insufficient Computational EffortThe software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
- CWE-311 - Missing Encryption of Sensitive DataThe software does not encrypt sensitive or critical information before storage or transmission.