CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: OpenSourcePOS의 저장형 교차 사이트 스크립팅 XSS 메타데이터| 세부 사항 ---|--- CVE ID| CVE-2025-68147 심각도| 높음 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N 취약점 유형| 저장형 교차 사이트 스크립팅 CWE-79 영향을 받는 버전| OpenSourcePOS v3.4.0, v3.4.1 패치된 버전| v3.4.2 취약한 구성 요소| 매장 구성 모듈 반품 정책 필드 보고자| Aditya Singh Nixon-H 📝 요약...

CVE-2025-68434-OSPOS-CSRF

CVE-2025-68434: OpenSourcePOS에서 CSRF를 통한 무단 관리자 생성 메타데이터| 세부사항 ---|--- CVE ID| CVE-2025-68434 심각도| 심각 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 취약점 유형| 사이트 간 요청 위조 CWE-352 영향받는 버전| OpenSourcePOS v3.4.0, v3.4.1 패치 버전| v3.4.2 취약한 구성 요소| app/Config/Filters.php 전역 보안 필터 제보자| Aditya Singh Nixon...

CVE-2026-19895

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-19895

CVE-2026-19895 affects open source POS Open Source Point of Sale, version up to 3.4.2. The vulnerability lies in Login::index (file app/Config/Filters.php, Login Endpoint), where excessive authentication attempts are improperly restricted. This allows a remote attack with high complexity; exploit...

CVE-2026-19895: Improper Restriction of Excessive Authentication Attempts

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

OpenSourcePOS 3.4.1 Cross Site Request Forgery

OpenSourcePOS version 3.4.1 suffers from a cross site request forgery vulnerability...

📄 OpenSourcePOS 3.4.1 Cross Site Request Forgery

OpenSourcePOS version 3.4.1 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : OpenSourcePOS 3.4.1 CSRF Vulnerability Leading to Unauthorized Admin...

CVE-2026-8802 opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument picfilename results in path traversal. The attack may be launched remotely. The patch is...

EUVD-2026-30761

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument picfilename results in path traversal. The attack may be launched remotely. The patch is...

PT-2026-41666

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic filename results in path traversal. The attack may be launched remotely. The patch is...

CVE-2026-8802: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument picfilename results in path traversal. The attack may be launched remotely. The patch is...

CVE-2026-8803: Use of Weak Hash

A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to...

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

CVE-2026-26745: Improper Neutralization of Special Elements used in an SQL Command

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

CVE-2026-26746

OpenSourcePOS 3.4.1 contains a Local File Inclusion LFI vulnerability in the Sales.php::getInvoice function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code...

CVE-2026-26746

OpenSourcePOS version 3.4.1 is vulnerable to a Local File Inclusion (LFI) vulnerability within the Sales.php::getInvoice() function. An attacker can manipulate the Invoice Type configuration to read arbitrary files on the web server. Furthermore, this vulnerability can be chained with the softwar...

CVE-2026-26746

OpenSourcePOS 3.4.1 contains a Local File Inclusion LFI vulnerability in the Sales.php::getInvoice function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code...

CVE-2026-26746: Unrestricted Upload of File with Dangerous Type

OpenSourcePOS 3.4.1 contains a Local File Inclusion LFI vulnerability in the Sales.php::getInvoice function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code...

opensourcepos 安全漏洞

opensourcepos is an open-source POS system developed by opensourcepos. Version 3.4.1 of opensourcepos contains a security vulnerability, which stems from improper handling of the currencysymbol configuration field. This vulnerability may lead to a second-level SQL injection attack...