An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

Published Feb 13, 2026 · Updated Feb 13, 2026 · Assigned by mitre