Cross-Site Scripting Vulnerability in OpenSourcePOS by OpenSourcePOS
CVE-2025-70095

6.5MEDIUM

Key Information:

Vendor

OpenSourcePOS

Status
OpenSourcePOS
Vendor
CVE Published:
13 February 2026

What is CVE-2025-70095?

A Cross-Site Scripting (XSS) vulnerability exists within the item management and sales invoice features of OpenSourcePOS version 3.4.1. This vulnerability enables attackers to inject malicious web scripts or HTML code into the application. If successfully exploited, this flaw could allow unauthorized execution of arbitrary scripts, potentially compromising users' sensitive information and the integrity of the application. Organizations using this version should take immediate precautions to secure their systems and mitigate potential risks.

References

https://github.com/opensourcepos/opensourcepos
https://github.com/hungnqdz/cve-research/blob/main/CVE-20...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.