PT-2026-8001 · Unknown · Opensourcepos

CVE-2025-70091 · Published 2026-02-13 · Updated 2026-02-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description An issue exists in OpenSourcePOS that allows for the execution of arbitrary web scripts or HTML. This occurs through a cross-site scripting (XSS) flaw within the Customers function. Specifically, the vulnerability is triggered by injecting a crafted payload into the Phone Number parameter.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing the Phone Number parameter input to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70091

Affected Products

Opensourcepos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70091.json · Exploit
• 🔥 https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70091.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70091 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70091 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2022358655748735400 · Twitter Post
• https://opensourcepos.org · Note