CVE-2025-70095
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows attackers to run malicious scripts on the OpenSourcePOS platform, potentially stealing sensitive information from users or manipulating transactions. It occurs when an attacker can inject harmful code into the item management or sales invoice sections, which requires them to have access to those functions in the application.
Technical Description
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 13, 2026
7 days ago
Last Modified
Feb 17, 2026
3 days ago
Vendor
opensourcepos
Product
open source point of sale
Related Vulnerabilities
This vulnerability allows attackers to run malicious scripts on a user's browser by injecting harmful code into the Item Category field when generating barcodes. It requires the attacker to have access to the web interface of OpenSourcePOS, making it important for users to be cautious about input validation and access controls.
This vulnerability allows attackers to run any code they want on the OpenSourcePOS system by sending a specially crafted response through AJAX. It requires the attacker to have access to the system's web interface, making it a serious risk if proper security measures are not in place.
This vulnerability allows attackers to run malicious scripts in a user's browser by injecting harmful code into the Phone Number field in the Customers function of OpenSourcePOS v3.4.1. It requires the attacker to trick a user into visiting a page where this code is executed, potentially leading to data theft or session hijacking.