1175 matches found
CVE-2026-19426 FitSoft｜POS Sytstem - Missing Authentication
POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...
CVE-2026-70560: Improper Neutralization of Input During Web Page Generation
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
PT-2026-71035
POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...
PT-2026-71057
Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...
CVE-2026-19426: Missing Authentication for Critical Function
POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system...
CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint
The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...
CVE-2026-14328
The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...
CVE-2026-16078
CVE-2026-16078 affects the WCPOS
CVE-2026-16078: Improper Limitation of a Pathname to a Restricted Directory
The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...
WordPress WCPOS – Point of Sale (POS) plugin for WooCommerce plugin <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read vulnerability
Authenticated Shop Manager+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce POS versions = 1.9.8...
CVE-2026-60170: Improper Access Control
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications component: POS. Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
CVE-2026-60167: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications component: POS. Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
CVE-2026-60169: Missing Authentication for Critical Function
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications component: POS. Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to...
CVE-2026-60168: Improper Access Control
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications component: POS. Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
CVE-2026-57688
Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...
CVE-2026-57688
The CVE concerns the WordPress POS Entegratör plugin (versions
CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...
CVE-2026-57688 WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...
