Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: vitepos 3.6.0 Clear all filters
TI-2026-12060 CVE-2026-14238 · GHSA-q4j7-5cq8-7g9h

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

Priority LOW 19

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrat…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00311 Published 2026-08-10 Fixed in 3.6.0 CWE-89
TI-2026-12059 CVE-2026-14237 · GHSA-x2ww-v6rp-cf3p

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

Priority LOW 34

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00462 Published 2026-08-10 Fixed in 3.6.0, 3.5.0 CWE-269