CVE-2025-60503

The UltimatePOS (v4.8) administrative interface is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw occurs because the Reference No. field in the Purchases module accepts unsanitized user input, which is subsequently rendered without proper escaping on the Reports $\rightarrow$ Activity...

CVE-2018-17139

CVE-2018-17139 affects UltimatePOS 2.5. An arbitrary file upload vulnerability allows an attacker to upload files via the /products endpoint (content-type: image/jpeg) containing PHP code, enabling remote command execution. Evidence across CNVD-2018-19402 and NVD/NVD-derived entries confirms the ...