Skip to content
OpenAdvisories

Vendor

Blair2004

2 known vulnerabilities.

Products

NexoPOS 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-117606

    NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

    NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.us…

    Blair2004 NexoPOS
  • Medium 5.3
    CVE-2026-111637

    NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

    NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-tran…

    Blair2004 NexoPOS