118 matches found
CVE-2026-92766
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-92766
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.5.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the 'src_by' parameter within the /vitepos/v1/vendor/list REST route. T...
CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
EUVD-2026-102824
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.5.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Muboriz in WordPress Plugin Vitepos versions = 3.5.1...
CVE-2026-109414
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-109414
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 3.6.1 . The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL queries, specifically re...
EUVD-2026-102677
The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...
WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.6.1 - Authenticated (Vendor+) SQL Injection vulnerability
Authenticated Vendor+ SQL Injection vulnerability discovered by John Ryan Albon in WordPress Plugin Vitepos versions = 3.6.1...
Vitepos-CVE-Report
Vitepos-CVE-Report Disclosure for CVE-2025-13156 CVE-2025-13156 - Vulnerability in Vitepos – Point of Sale POS for WooCommerce This repository discloses a vulnerability discovered in Vitepos – Point of Sale POS for WooCommerce =' \ -H 'X-WP-Nonce: ' \ -F 'categoryname=evil' \ -F 'categoryparent=0...
CVE-2026-105076
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076
The Appsbd Vitepos vitepos-lite WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 3.6.1 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This flaw allows an attacker to perform unauthorized database queries. N...
CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
EUVD-2026-94942
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin Vitepos versions = 3.6.1...
CVE-2026-96815
Custom role Privilege Escalation in Vitepos = 3.5.0 versions...
EUVD-2026-89868
Custom role Privilege Escalation in Vitepos = 3.5.0 versions...
