31 matches found
CVE-2025-60503
CVE-2025-60503 — UltimatePOS UltimateFosters v4.8의 저장형 크로스 사이트 스크립팅XSS 공개 날짜: 2025-10-30 CVE ID: CVE-2025-60503 예약됨 연구자: Vivien Lebas 공급업체: UltimateFosters 제품: UltimatePOS 영향을 받는 버전: 4.8 취약점 유형: 저장형 크로스 사이트 스크립팅XSS 심각도: 높음 개요 UltimatePOS 관리자 패널v4.8에는 저장형 XSS 취약점이 존재합니다. 구매Purchases 모듈의 Reference...
📄 UltimatePOS 4.8 Cross Site Scripting
The administrative panel in UltimatePOS version 4.8 suffers from a persistent cross site scripting vulnerability. CVE-2025-60503 — Stored Cross-Site Scripting XSS in UltimatePOS UltimateFosters v4.8 Publication date: 2025-10-30 CVE ID: CVE-2025-60503 RESERVED Researcher: Vivien Lebas Vendor:...
CVE-2025-40980
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
EUVD-2025-37504
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2025-60503
The UltimatePOS (v4.8) administrative interface is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the Reference No. field in the Purchases module accepts unsanitized user input, which is subsequently rendered without proper escaping on the Reports $\rightarrow$ Activity...
PT-2025-44782
Name of the Vulnerable Software and Affected Versions ultimatefosters UltimatePOS version 4.8 Description A cross-site scripting XSS flaw exists in the administrative interface of the software. Input provided in the purchase functionality is reflected without proper sanitization in the admin log...
Exploit for CVE-2025-60503
CVE-2025-60503 — Stored Cross-Site Scripting XSS in Ultimate...
EUVD-2018-8917
Malware in sbrugna...
EUVD-2025-23260
Malicious code in bioql PyPI...
CVE-2025-40980
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
CVE-2025-40980 ddd
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
CVE-2025-40980
Summary: CVE-2025-40980 is a Stored XSS in UltimatePOS by UltimateFosters. An unsanitized value in the name field of POST requests to /products//edit can be reflected in pages (e.g., Reports/Activity Log), enabling an authenticated attacker to execute arbitrary JavaScript in an admin/user browser...
CVE-2025-40980 ddd
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...
PT-2025-31500 · Unknown · Ultimatepos
Name of the Vulnerable Software and Affected Versions: UltimatePOS affected versions not specified Description: A Stored Cross Site Scripting vulnerability exists in UltimatePOS due to inadequate validation of user inputs. The vulnerability affects the name parameter via a POST request to the...
CVE-2025-40980: Improper Neutralization of Input During Web Page Generation
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products/ /edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a special...