Skip to content
OpenAdvisories

Vendor

opensourcepos

10 known vulnerabilities.

opensourcepos at a glance

Last 12 months
10
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 2 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 2 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202600
Jun 202600
May 202620
Apr 202620
Mar 202620
Feb 202600
Jan 202610
Dec 202520
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

opensourcepos 7 Open Source Point of Sale 3
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Low 3.7
    CVE-2026-19895

    opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

    A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authe…

    opensourcepos Open Source Point of Sale
  • Low 3.7
    CVE-2026-8803

    opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash

    A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is p…

    opensourcepos Open Source Point of Sale
  • Medium 4.3
    CVE-2026-8802

    opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal

    A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be …

    opensourcepos Open Source Point of Sale
  • Medium 5.4
    CVE-2026-32712

    Open Source Point of Sale has Stored XSS in Customer Name (Sales)

    Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured…

    opensourcepos opensourcepos
  • Medium 5.4
    CVE-2026-39380

    Open Source Point of Sale has Stored XSS in Stock Location (Configuration)

    Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to prop…

    opensourcepos opensourcepos
  • Medium 6.5
    CVE-2026-33730

    Open Source Point of Sale has an IDOR in Password Change (Home)

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to acce…

    opensourcepos opensourcepos
  • High 8.8
    CVE-2026-32888

    Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality

    Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), use…

    opensourcepos opensourcepos
  • Medium 4.3
    CVE-2025-68658

    Open Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name field

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration (Information) functionality. An authenticat…

    opensourcepos opensourcepos
  • High 8.8
    CVE-2025-68434 Public exploit

    opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's …

    opensourcepos opensourcepos
  • High 8.1
    CVE-2025-68147 Public exploit

    opensourcepos has a Cross-site Scripting vulnerability

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy…

    opensourcepos opensourcepos