21210 matches found
Exploit for CVE-2025-68434
CVE-2025-68434: CSRF Unauthorized Administrator Creation in Op...
CVE-2025-66921
A Cross-site scripting XSS vulnerability in Create/Update Items Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
CVE-2025-66921
A Cross-site scripting XSS vulnerability in Create/Update Items Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
CVE-2025-66924
A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
Model Context Protocol Server Path Traversal Vulnerabilities
Model Context Protocol Servers is a large model context protocol server from Model Context Protocol open source. A path traversal vulnerability exists in versions of Model Context Protocol Servers prior to 2025.12.17, which stems from a failure to verify that the repopath parameter in subsequent...
PT-2025-51849
A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
CVE-2025-68434: Cross-Site Request Forgery (CSRF)
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery CSRF vulnerability exists in the application's filter configuration. The CSRF protection...
CVE-2025-66924: Improper Neutralization of Input During Web Page Generation
A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
CVE-2025-66923: Improper Input Validation
A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...
CVE-2025-66923
A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...
PT-2025-51928
Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message, including the host, IP address, username, and password...
CVE-2025-68147: Improper Neutralization of Input During Web Page Generation
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting XSS vulnerability exists in the "Return Policy" configuration field. The application doe...
CVE-2025-66924
A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
Bounty Hunter: Autonomous, Comprehensive Emulation of Multi-Faceted Adversaries
Adversary emulation is an essential procedure for cybersecurity assessments such as evaluating an organization's security posture or facilitating structured training and research in dedicated environments. To allow for systematic and time-efficient assessments, several approaches from academia an...
CVE-2025-66923
A Cross-site scripting (XSS) vulnerability exists in Open Source Point of Sale v3.4.1 within the Create/Update Customer(s) functionality. The root cause is an unvalidated phone_number parameter, which allows remote attackers to inject arbitrary web script or HTML. While specific remediation steps...
CVE-2025-66921
A Cross-site scripting (XSS) vulnerability exists in the Create/Update Item(s) Module of Open Source Point of Sale v3.4.1 . The root cause is improper input validation (CWE-20) and improper neutralization of input (CWE-79) regarding the "name" parameter . This flaw allows remote attackers to inje...
CVE-2025-66921: Improper Input Validation
A Cross-site scripting XSS vulnerability in Create/Update Items Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...
Open Source Point of Sale security vulnerabilities
Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A security vulnerability exists in Open Source Point of Sale version v3.4.1, which stems from improper handling of the name parameter in the Create/Update Items module, which could lead to a cross-site...
Open Source Point of Sale Cross-Site Request Forgery Vulnerability
Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site request forgery vulnerability exists in Open Source Point of Sale versions prior to 3.4.2, which stems from an explicit disabling of the CSRF protection mechanism, which could lead to a...