Vulnerabilities

TI-2026-25204 CVE-2026-32712

Open Source Point of Sale has Stored XSS in Customer Name (Sales)

MEDIUM 58

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00176 Published 2026-04-07 Fixed in 3.4.3 CWE-79

TI-2026-28365 CVE-2026-39380

Open Source Point of Sale has Stored XSS in Stock Location (Configuration)

MEDIUM 58

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00168 Published 2026-04-07 Fixed in 3.4.3 CWE-79

TI-2026-26109 CVE-2026-33730

Open Source Point of Sale has an IDOR in Password Change (Home)

MEDIUM 62

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00287 Published 2026-03-27 Fixed in 3.4.2 CWE-639

TI-2026-25347 CVE-2026-32888

Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality

HIGH 73

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00329 Published 2026-03-20 No fix listed CWE-89

TI-2026-21383 CVE-2026-26746 · GHSA-8p85-wjp4-3w4m

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the…

MEDIUM 41

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00662 Published 2026-02-20 No fix listed CWE-434

TI-2026-21382 CVE-2026-26745 · GHSA-fqrw-hvqv-r58w

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the…

LOW 24

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00347 Published 2026-02-20 No fix listed CWE-89

TI-2025-43029 CVE-2025-70095 · GHSA-qqhc-37jx-7gh5

A cross-site scripting (XSS) vulnerability in the item management and sales invoice…

MEDIUM 62

A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-13 No fix listed CWE-79

TI-2025-43028 CVE-2025-70094 · GHSA-3669-8ww5-g35f

A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of…

MEDIUM 62

A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Category pa…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-13 No fix listed CWE-79

TI-2025-43027 CVE-2025-70093 · GHSA-r3p8-h9vv-9cqc

An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

HIGH 68

An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00398 Published 2026-02-13 No fix listed CWE-77

TI-2025-43025 CVE-2025-70091 · GHSA-vwfj-gc28-j2fg

A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS…

MEDIUM 62

A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-13 No fix listed CWE-79

TI-2025-43026 CVE-2025-70092 · GHSA-649g-63pg-hvqg

A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS…

LOW 24

A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00227 Published 2026-02-12 No fix listed CWE-79

TI-2025-42152 CVE-2025-68658

Open Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name field

LOW 21

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00219 Published 2026-01-13 Fixed in 3.4.2 CWE-79

TI-2025-41982 CVE-2025-68434

opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

HIGH 73

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00281 Published 2025-12-17 Fixed in 3.4.2 CWE-352

TI-2025-41728 CVE-2025-68147

opensourcepos has a Cross-site Scripting vulnerability

HIGH 70

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00376 Published 2025-12-17 Fixed in 3.4.2 CWE-79

TI-2025-41088 CVE-2025-66924 · GHSA-9864-3rvj-vv32

A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source…

MEDIUM 62

A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00264 Published 2025-12-17 No fix listed CWE-79

TI-2025-41087 CVE-2025-66923 · GHSA-g23m-jjp5-jc3m

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source…

HIGH 67

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00552 Published 2025-12-17 No fix listed CWE-20

TI-2025-41086 CVE-2025-66921 · GHSA-56hc-g777-9p48

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source…

HIGH 67

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00552 Published 2025-12-17 No fix listed CWE-20

TI-2025-39460 CVE-2025-63800 · GHSA-q9j2-x62q-rv7w

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their…

LOW 33

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00479 Published 2025-11-18 No fix listed CWE-521

TI-2022-15425 CVE-2022-34578 · GHSA-pxvc-9m9j-4r9v

Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload…

LOW 34

Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01188 Published 2022-07-28 No fix listed CWE-434

Vulnerabilities

Filters