CVE-2021-3122-Details

CVE-2021-3122-Detalles Entrada de blog sobre cómo encontramos un CVE en AlohaPOS. https://www.sentinelone.com/blog/cve-2021-3122-how-we-caught-a-threat-actor-exploiting-ncr-pos-zero-day/...

CVE-2018-2636

Instalación root@kitploit: $ pip install --user requests argparse unicodedata Información PoC para CVE-2018-2636. Ejemplo de uso root@kitploit: python eGw.py -H 127.0.0.1 -P 8080 -i ... Let's get info about server ! Your instance is vulnerable to CVE-2018-2636 ... Enlaces Oracle Critical Patch...

CVE-2024-13513

Oliver POS – Un punto de venta POS de WooCommerce = 2.4.2.3 - Exposición de Información Sensible a Escalada de Privilegios Toma de Control de Cuenta CVE-2024-13513 El plugin Oliver POS – Un punto de venta POS de WooCommerce para WordPress es vulnerable a la Exposición de Información Sensible en...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

POS Codekop v2.0 - Cross Site Scripting

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php. id: CVE-2023-36346 info: name: POS Codekop v2.0 - Cross Site Scripting author: r3Y3r53 severity: medium description: | POS Codekop v2.0 was discovered to contain ...

primefaces

De la Mesa al Código: Un Viaje a Través de la Vulnerabilidad RCE en POS para Restaurantes En esta oportunidad nos encontramos por casualidad con una vulnerabilidad presente en varias aplicaciones de POS para restaurantes XETUX, la cual es una solución para monitoreo y automatización de...

PT-2026-90862

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust pos trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made...

CVE-2025-67263

CVE-2025-67263 - Cross-site scripting almacenado XSS en Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 está afectado por una vulnerabilidad de cross-site scripting almacenado XSS en el módulo de Clientes. La aplicación no sanitiza correctamente la entrada...

CVE-2025-67261

CVE-2025-67261 - Inyección SQL ciega basada en contenido en Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 es vulnerable a la inyección SQL ciega basada en contenido. La vulnerabilidad existe en la función Search de la página Orders. La función "Search" de la página...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-74769

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Almacenamiento en texto claro de información sensible en memoria en Abacre Restaurant Point of Sale POS. Todas las versiones de Abacre Restaurant Point of Sale POS hasta la 15.0.0.1656 son vulnerables al almacenamiento en texto claro de información sensible en...

CVE-2026-71803

money-pos 1.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, concatenating it directly into the order log description, which the frontend renders using v-html . An attacker with product crea...

EUVD-2026-75158

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-16025

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2025-65320

CVE-2025-65320 Título Almacenamiento en texto claro de material de licencia confidencial en la memoria del proceso en Abacre Restaurant Point of Sale POS Resumen Existe una vulnerabilidad en Abacre Restaurant Point of Sale POS versiones = 15.0.0.1656 donde los datos confidenciales de licencia se...

CVE-2026-19081 Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19081

CVE-2026-19081 is a Missing Authorization vulnerability in Gastromenum Ticket and QR Menu System , a point-of-sale (POS) and QR menu product. The flaw allows an authenticated low-privilege network user to access functionality not properly constrained by ACLs, specifically enabling unauthorized ac...