PT-2025-44782 · Ultimatefosters · Ultimatepos

Published 2025-11-03 · Updated 2026-02-03 · CVE-2025-60503

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ultimatefosters UltimatePOS version 4.8

Description A cross-site scripting (XSS) flaw exists in the administrative interface of the software. Input provided in the purchase functionality is reflected without proper sanitization in the admin log panel page, specifically within the 'reference No.' field. This allows an authenticated attacker to inject and execute arbitrary JavaScript code within an administrator's browser session, potentially leading to session hijacking or other malicious activities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60503

Affected Products

Ultimatepos

References · 8

• 🔥 https://github.com/H4zaz/CVE-2025-60503 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60503 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60503 · Vendor Advisory
• https://t.me/CVEtracker/36425 · Telegram Post
• https://twitter.com/cracbot/status/1987112927707701374 · Twitter Post
• https://t.me/cveNotify/150732 · Telegram Post
• https://ultimatefosters.com · Note
• https://twitter.com/cracbot/status/1986750540861288731 · Twitter Post