CVE-2018-17139

CVE-2018-17139 affects UltimatePOS 2.5. An arbitrary file upload vulnerability allows an attacker to upload files via the /products endpoint (content-type: image/jpeg) containing PHP code, enabling remote command execution. Evidence across CNVD-2018-19402 and NVD/NVD-derived entries confirms the ...

CVE-2025-60503

A cross-site scripting (XSS) vulnerability exists in UltimatePOS 4.8 (admin purchases). User input in the Purchases > reference No. field is reflected in the Admin Log panel without proper escaping, enabling an authenticated attacker to execute JavaScript in an admin session (potential session...