PT-2026-21255 · Unknown · Opensourcepos

Hungnqdz · Published 2026-02-20 · Updated 2026-02-23 · CVE-2026-26745

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description The software contains a second order SQL Injection issue in how it handles the currency symbol configuration field. The input is stored and later used in a dynamically constructed SQL query without proper sanitization. This allows an attacker who can modify the currency symbol value to inject SQL expressions that are executed when the query is processed. The vulnerable configuration field is currency symbol.

Recommendations Apply updates to address the improper handling of the currency symbol configuration field.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-26745

Affected Products

Opensourcepos

References · 5

• 🔥 https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26745 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26745 · Vendor Advisory
• https://github.com/opensourcepos/opensourcepos · Note
• https://twitter.com/CVEnew/status/2025809090732326997 · Twitter Post