XSS Vulnerability in UltimatePOS 4.8 by UltimateFosters

CVE-2025-60503

What is CVE-2025-60503?

A cross-site scripting (XSS) vulnerability exists in the administrative interface of UltimatePOS 4.8. It allows malicious users to input data in the purchase functionality, which gets reflected without proper escaping in the admin log panel, specifically in the 'reference No.' field. This flaw enables authenticated attackers to execute arbitrary JavaScript code within the context of an administrator's browser session, potentially leading to unauthorized data access, session hijacking, and other harmful actions.

References