Cross-Site Scripting Vulnerability in OpenSourcePOS by OpenSourcePOS
CVE-2025-70091

6.5MEDIUM

Key Information:

Vendor

OpenSourcePOS

Status
OpenSourcePOS
Vendor
CVE Published:
13 February 2026

What is CVE-2025-70091?

A cross-site scripting vulnerability exists in the Customers function of OpenSourcePOS v3.4.1, enabling attackers to execute arbitrary web scripts or HTML. This is achieved by injecting a malicious payload into the Phone Number parameter, which can compromise user data and lead to unauthorized access. Ensuring proper input validation and sanitation is crucial to mitigating such vulnerabilities.

References

https://www.opensourcepos.org
https://github.com/hungnqdz/cve-research/blob/main/CVE-20...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.