PT-2026-7996 · Unknown · Opensourcepos

Published 2026-02-13 · Updated 2026-02-13 · CVE-2025-70094

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description An issue exists in OpenSourcePOS that allows for the execution of malicious web scripts or HTML. This occurs through a cross-site scripting (XSS) flaw within the Generate Item Barcode function. Specifically, the vulnerability is triggered by injecting a crafted payload into the Item Category parameter.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing the Item Category parameter input to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70094

Affected Products

Opensourcepos

References · 6

• 🔥 https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70094.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-70094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70094 · Security Note
• https://github.com/opensourcepos/opensourcepos/pull/4357 · Note
• https://twitter.com/VulmonFeeds/status/2022353535677915430 · Twitter Post
• https://opensourcepos.org · Note