PT-2026-7917 · Unknown · Opensourcepos

Published 2026-02-12 · Updated 2026-02-18 · CVE-2025-70092

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description An issue exists in the Item Kits function that permits the execution of arbitrary web scripts or HTML. This occurs through the injection of a crafted payload into the Item Name parameter. The vulnerability is a cross-site scripting (XSS) issue.

Recommendations Apply a fix to address the vulnerability in the Item Kits function, specifically regarding the handling of the Item Name parameter.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70092

Affected Products

Opensourcepos

References · 6

• 🔥 https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70092.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70092 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70092 · Vendor Advisory
• https://t.me/CVEtracker/44587 · Telegram Post
• https://t.me/cveNotify/152352 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2022148646121197937 · Twitter Post