CVE-2025-10067

31th percentile - higher than 31% of all known CVEs

A vulnerability was discovered in itsourcecode POS Point of Sale System 1.0 involving cross-site scripting in the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Manipulation of the scripts argument allows remote attack execution. The exploit is publicly available and may be used.

An attacker can remotely inject a malicious script that executes in the user's browser, potentially leading to session theft or other attacks. The public exploit increases the risk.

Sanitize input data and use appropriate security headers, e.g., Content-Security-Policy. Restrict access to the vulnerable file.