open_source_point_of_sale vulnerabilities

CVEs whose affected-version data names the open_source_point_of_sale package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

6 CVEsRSS

CVE-2026-32712Medium· 5.4

6mo ago

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_nam…

▾ Sunlitopensourcepos · open_source_point_of_saleEPSS 0.17%via NVD

CVE-2025-68434High· 8.8PoC

10mo ago

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists…

▾ Midnightopensourcepos · open_source_point_of_saleEPSS 0.28%via NVD

CVE-2025-68147High· 8.1PoC

10mo ago

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists…

▾ Midnightopensourcepos · open_source_point_of_saleEPSS 0.38%via NVD

CVE-2025-66924Medium· 6.1

10mo ago

A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

▾ Sunlitopensourcepos · open_source_point_of_saleEPSS 0.26%via NVD

CVE-2025-66923High· 7.2

10mo ago

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.

▾ Twilightopensourcepos · open_source_point_of_saleEPSS 0.55%via NVD

CVE-2025-66921High· 7.2

10mo ago

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

▾ Twilightopensourcepos · open_source_point_of_saleEPSS 0.55%via NVD