PT-2026-2492 · Opensourcepos+1 · Open Source Point Of Sale+1

Published 2026-01-13 · Updated 2026-01-21 · CVE-2025-68658

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale versions 3.4.0 through 3.4.1

Description Open Source Point of Sale is a web-based point of sale application written in PHP using the CodeIgniter framework. A stored cross-site scripting (XSS) issue exists in the Configuration (Information) functionality. An authenticated user with the “Configuration: Change OSPOS's Configuration” permission can inject a malicious JavaScript payload into the Company Name field when updating Information in Configuration. The payload is stored and executed when a user accesses the /sales/complete endpoint. The issue is due to insufficient input validation and output encoding. The malicious code is triggered when selecting Sales, choosing New Item to create an item, and then clicking on Completed. The vulnerable parameter is the Company Name field.

Recommendations Update to version 3.4.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68658

GHSA-32R8-8R9R-9CHW

Affected Products

Open Source Point Of Sale

Opensourcepos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68658.json · Exploit
• https://github.com/opensourcepos/opensourcepos/commit/849439c71eaa4c15857fb7c603297261c2ddc26d · Patch
• https://osv.dev/vulnerability/CVE-2025-68658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68658 · Security Note
• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-32r8-8r9r-9chw · Note
• https://t.me/cveNotify/149431 · Telegram Post