Stored Cross Site Scripting Vulnerability in UltimatePOS by UltimateFosters
CVE-2025-40980
5.1MEDIUM
What is CVE-2025-40980?
A stored cross site scripting vulnerability has been identified in UltimatePOS by UltimateFosters, resulting from inadequate validation of user inputs. This issue is particularly present in the '/products/<PRODUCT_ID>/edit' functionality, where the 'name' parameter can be exploited via POST requests. Attackers can craft a malicious query targeting authenticated users, potentially leading to the theft of session cookies and unauthorized access to user accounts.
Affected Version(s)
UltimatePOS 6.4;