CVE-2025-66924

A Cross-site scripting (XSS) vulnerability exists in Open Source Point of Sale v3.4.1 within the Create/Update Item Kit(s) functionality. The root cause is an unvalidated "name" parameter , which allows remote attackers to inject arbitrary web scripts or HTML. Exploitation details are not provide...

CVE-2025-66924: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...