CVE-2025-66921

In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.

Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.

Stored XSS vulnerability in Open Source Point of Sale before version 3.4.3. Insufficient input sanitization in the stock_location parameter allows injection of malicious JavaScript that executes in the Employees interface.

In Open Source Point of Sale (opensourcepos) versions 3.4.0 through 3.4.1, there is a stored XSS vulnerability in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts, allowing an attacker with access to store configuration to inject malicious JavaScript.

A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.