PT-2026-3640 · Abacre · Abacre Retail Point Of Sale

Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-67263

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Abacre Retail Point of Sale version 14.0.0.396

Description The application does not properly sanitize user-supplied input in the Name and Surname fields within the Clients module, leading to a stored cross-site scripting (XSS) issue. An attacker can inject malicious HTML or script content into these fields, which is then saved in the database.

Recommendations Ensure proper sanitization of user input for the Name and Surname fields in the Clients module.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67263

Affected Products

Abacre Retail Point Of Sale

References · 5

• https://osv.dev/vulnerability/CVE-2025-67263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67263 · Security Note
• https://twitter.com/CVEnew/status/2013683558695542949 · Twitter Post
• https://abacre.com/retailpointofsale · Note
• https://packetstorm.news/files/id/214045 · Note