Stored XSS Vulnerability in Open Source Point of Sale Application by Open Source

CVE-2025-68658

What is CVE-2025-68658?

The Open Source Point of Sale (opensourcepos) application has a stored XSS vulnerability in the Configuration function. Authenticated users with specific permissions can inject a malicious JavaScript payload into the Company Name field while updating configuration details. This payload is stored and subsequently executed when a user accesses certain functionalities, leading to the potential compromise of user browsers. The issue arises due to improper input validation and output encoding, highlighting significant security shortcomings in the affected versions. Users are urged to upgrade to version 3.4.2 to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References