Vitepos-CVE-Report

Vitepos-CVE-Report Disclosure for CVE-2025-13156 CVE-2025-13156 - Vulnerability in Vitepos – Point of Sale POS for WooCommerce This repository discloses a vulnerability discovered in Vitepos – Point of Sale POS for WooCommerce =' \ -H 'X-WP-Nonce: ' \ -F 'categoryname=evil' \ -F 'categoryparent=0...

CVE-2026-92766

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

EUVD-2026-102824

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-92766

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.5.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the 'src_by' parameter within the /vitepos/v1/vendor/list REST route. T...

CVE-2026-92766 Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Muboriz in WordPress Plugin Vitepos versions = 3.5.1...

CVE-2026-109414

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

EUVD-2026-102677

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-109414

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 3.6.1 . The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL queries, specifically re...

PT-2026-115452

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src by.val.start / src by.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-92766: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

PT-2026-115541

Name of the Vulnerable Software and Affected Versions Vitepos – Point of Sale POS for WooCommerce versions prior to 3.5.2 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow unauthenticated attackers or users with any POS role, such as...

CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.6.1 - Authenticated (Vendor+) SQL Injection vulnerability

Authenticated Vendor+ SQL Injection vulnerability discovered by John Ryan Albon in WordPress Plugin Vitepos versions = 3.6.1...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.5.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient cleaning and escaping of the srcby parameter, as well as inadequate preparation of existing SQL queries. This could allow unauthenticated attackers to append additional SQL...

WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...

CVE-2026-105076

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...