CVE-2026-117606

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606

Versions of NexoPOS up to and including 6.3.0 are vulnerable to a missing authorization flaw in the CashRegistersService . The system fails to verify if the used_by field matches the current user, allowing authenticated cashiers with the nexopos.use.registers permission to manipulate other cashie...

CVE-2026-117606

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

EUVD-2026-111541

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117606: Blair2004 NexoPOS: NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate…

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

PT-2026-127730

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used by with the user. Attackers holding the default nexopos.use.registers permission can submit...

Blair Jersyer NexoPOS authorization issue vulnerability

Blair Jersyer NexoPOS versions 6.3.0 and earlier contain an authorization issue vulnerability. This vulnerability arises because CashRegistersService fails to compare usedby against users, resulting in a lack of proper authorization checks. Authenticated cashiers possessing the default...

CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

PT-2026-123291

Name of the Vulnerable Software and Affected Versions NexoPOS version 6.2.4 Description An issue exists in the point-of-sale system that allows remote users to read files on the server. This is achieved through a directory traversal flaw at the 'api/update' endpoint, where directory traversal is ...

CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

Blair Jersyer NexoPOS security vulnerability

A security vulnerability exists in Blair Jersyer NexoPOS version 6.2.4; it stems from directory traversal in the api/update endpoint...

EUVD-2026-109893

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

CVE-2026-107092

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint...

CVE-2026-107092

The software NexoPOS v6.2.4 is vulnerable to a Directory Traversal flaw located in the api/update endpoint. This vulnerability allows an attacker to potentially access files or directories outside of the intended web root. While the technical impact is rated as CRITICAL with a CVSS score of 9.8 ,...

CVE-2026-111637

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...