CVE-2018-2636

Установка root@kitploit: $ pip install --user requests argparse unicodedata Информация POC для CVE-2018-2636. Пример использования root@kitploit: python eGw.py -H 127.0.0.1 -P 8080 -i ... Let's get info about server ! Your instance is vulnerable to CVE-2018-2636 ... Ссылки Критическое обновление...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

POS Codekop v2.0 - Cross Site Scripting

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php. id: CVE-2023-36346 info: name: POS Codekop v2.0 - Cross Site Scripting author: r3Y3r53 severity: medium description: | POS Codekop v2.0 was discovered to contain ...

CVE-2024-13513

Oliver POS – WooCommerce 판매 시점 관리POS 플러그인 = 2.4.2.3 - 민감 정보 노출로 인한 권한 상승 계정 탈취 CVE-2024-13513 Oliver POS – WooCommerce 판매 시점 관리POS 플러그인 for WordPress는 2.4.2.3 이하 모든 버전에서 로깅 기능을 통해 민감 정보 노출에 취약합니다. 이로 인해 인증되지 않은 공격자가 플러그인의 clientToken을 포함한 민감 데이터를 추출할 수 있으며, 이를 통해 이메일 및 계정 유형을 포함한 사용자 계정 정보를 변경할 수...

primefaces

От стола к коду: Путешествие через уязвимость RCE в POS для ресторанов В этот раз мы случайно наткнулись на уязвимость, присутствующую в нескольких приложениях POS для ресторанов XETUX, которое является решением для мониторинга и автоматизации ресторанов. В Панаме этот инструмент широко...

CVE-2021-3122-Details

CVE-2021-3122-Подробности Пост в блоге о том, как мы нашли CVE в AlohaPOS. https://www.sentinelone.com/blog/cve-2021-3122-how-we-caught-a-threat-actor-exploiting-ncr-pos-zero-day/...

CVE-2025-67263

CVE-2025-67263 - Abacre Retail Point of Sale 14.0.0.396의 저장형 크로스 사이트 스크립팅 XSS Abacre Retail Point of Sale 14.0.0.396은 Clients 모듈의 저장형 크로스 사이트 스크립팅 XSS 취약점의 영향을 받습니다. 애플리케이션이 Name 및 Surname 필드에 저장된 사용자 제공 입력을 적절히 삭제sanitize하지 못합니다. 공격자는 이러한 필드에 악성 HTML 또는 스크립트 콘텐츠를 삽입할 수 있으며, 이는 데이터베이스에 지속됩니다...

CVE-2025-67261

CVE-2025-67261 - Abacre Retail Point of Sale 14.0.0.396의 콘텐츠 기반 블라인드 SQL 인젝션 Abacre Retail Point of Sale 14.0.0.396은 콘텐츠 기반 블라인드 SQL 인젝션에 취약합니다. 이 취약점은 Orders 페이지의 Search 기능에 존재합니다. Orders 페이지의 "Search" 기능은 콘텐츠 기반 블라인드 SQL 인젝션에 취약합니다. 간단한 페이로드로 초기 확인이 가능하며, 아래 쿼리를 사용하여 Firebird 데이터베이스 파일에 "Client...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Хранение конфиденциальной информации в открытом виде в памяти в Abacre Restaurant Point of Sale POS. Все версии Abacre Restaurant Point of Sale POS до 15.0.0.1656 включительно уязвимы к хранению конфиденциальной информации в открытом виде в памяти. Приложение...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntbhwswitchtec: Fixed an out-of-bounds situation in switchtecntbmwsettrans. There is a kernel API called ntbmwcleartrans, which passes 0 to both addr and size. This would cause xlatepos to become negative. 23.734156 switchtec...

CVE-2025-65320

CVE-2025-65320 Название Хранение конфиденциального лицензионного материала в открытом виде в памяти процесса в Abacre Restaurant Point of Sale POS Обзор Уязвимость существует в Abacre Restaurant Point of Sale POS версий = 15.0.0.1656, где конфиденциальные лицензионные данные хранятся в открытом...

PT-2026-90862

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust pos trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

EUVD-2026-74769

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-71803

money-pos 1.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, concatenating it directly into the order log description, which the frontend renders using v-html . An attacker with product crea...

EUVD-2026-75158

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-16025

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-19081 Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...