PT-2026-31007 · Opensourcepos · Opensourcepos

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39380

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39380

Affected Products

Opensourcepos

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-39380 · Security Note
• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg · Note