opensourcepos has 6 CVEs on record between 2025 and 2026. The busiest recent month was December 2025 with 5. The median CVSS is 7.2 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-68434High· 8.8Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework60CVE-2025-68147High· 8.1Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework57CVE-2025-66923High· 7.2A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.40CVE-2025-66921High· 7.2A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.40CVE-2025-66924Medium· 6.1A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.34
opensourcepos vulnerabilities
CVEs affecting opensourcepos, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-32712Medium· 5.4Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_nam…
CVE-2025-68434High· 8.8PoCOpen Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists…
CVE-2025-68147High· 8.1PoCOpen Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists…
CVE-2025-66924Medium· 6.1A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
CVE-2025-66923High· 7.2A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
CVE-2025-66921High· 7.2A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.