Vulnerabilities

TI-2025-37698 CVE-2025-60503 · GHSA-5gpc-893h-q6v2

A cross-site scripting (XSS) vulnerability exists in the administrative interface of…

HIGH 71

A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin l…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00411 Published 2025-11-03 No fix listed CWE-79

TI-2018-12246 CVE-2018-17139 · GHSA-9x5j-whx3-gg57

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command…

MEDIUM 44

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.03074 Published 2018-09-17 No fix listed CWE-434

Vulnerabilities

Filters

A cross-site scripting (XSS) vulnerability exists in the administrative interface of…

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command…