PT-2026-3637 · Abacre · Abacre Retail Point Of Sale

Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-67261

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Abacre Retail Point of Sale version 14.0.0.396

Description Abacre Retail Point of Sale 14.0.0.396 is susceptible to a content-based blind SQL injection issue. This issue is present in the Search function located on the Orders page. The vulnerability allows for potential unauthorized access to data through manipulation of SQL queries. The vulnerable function is Search(). The vulnerable page is the Orders page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67261

Affected Products

Abacre Retail Point Of Sale

References · 5

• https://osv.dev/vulnerability/CVE-2025-67261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67261 · Security Note
• https://packetstorm.news/files/id/214046 · Note
• https://twitter.com/CVEnew/status/2013673277668106488 · Twitter Post
• https://abacre.com/retailpointofsale · Note