CVE-2025-70093

An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

Score

CVSS 3.1 7.4 High

Status

Analyzed - cve@mitre.org

Published

2026-02-13

Last modified

2026-02-13

Weaknesses

CWE-77

Affected products

• Open Source Point Of Sale (Opensourcepos)

References

• https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70093.md
• https://github.com/opensourcepos/opensourcepos/pull/4357
• https://www.opensourcepos.org