Opensourcepos - vulnerabilities (CVEs)

22 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-15.

Products

• Open Source Point Of Sale - 22 CVEs
• Opensourcepos - 7 CVEs

Newest CVEs of Opensourcepos

• CVE-2026-19895 - CVSS 6.3 (medium), 2026-08-15: A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php…
• CVE-2026-8803 - CVSS 6.3 (medium), 2026-05-18: A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the…
• CVE-2026-8802 - CVSS 5.3 (medium), 2026-05-18: A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file…
• CVE-2026-32712 - CVSS 5.4 (medium), 2026-04-07: Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting…
• CVE-2026-39380 - CVSS 5.4 (medium), 2026-04-07: Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting…
• CVE-2026-33730 - CVSS 6.5 (medium), 2026-03-27: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an…
• CVE-2026-32888 - CVSS 8.8 (high), 2026-03-20: Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items…
• CVE-2026-26746 - CVSS 8.8 (high), 2026-02-20: OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the…
• CVE-2026-26745 - CVSS 5.3 (medium), 2026-02-20: OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially…
• CVE-2025-70095 - CVSS 6.5 (medium), 2026-02-13: A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web…
• CVE-2025-70091 - CVSS 6.5 (medium), 2026-02-13: A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via…
• CVE-2025-70094 - CVSS 6.5 (medium), 2026-02-13: A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or…
• CVE-2025-70093 - CVSS 7.4 (high), 2026-02-13: An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.
• CVE-2025-70092 - CVSS 5.5 (medium), 2026-02-12: A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via…
• CVE-2025-68658 - CVSS 4.8 (medium), 2026-01-13: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1…
• CVE-2025-68434 - CVSS 8.8 (high), 2025-12-17: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and…
• CVE-2025-68147 - CVSS 8.1 (high), 2025-12-17: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and…
• CVE-2025-66924 - CVSS 6.1 (medium), 2025-12-17: A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web…
• CVE-2025-66923 - CVSS 7.2 (high), 2025-12-17: A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web…
• CVE-2025-66921 - CVSS 7.2 (high), 2025-12-17: A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web…
• CVE-2025-63800 - CVSS 7.5 (high), 2025-11-18: The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side…
• CVE-2022-34578 - CVSS 7.2 (high), 2022-07-28: Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.