CVE-2025-68147
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In Open Source Point of Sale (opensourcepos) versions 3.4.0 through 3.4.1, there is a stored XSS vulnerability in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts, allowing an attacker with access to store configuration to inject malicious JavaScript.
Risk Assessment
Injected JavaScript can be executed in the browser of any user (including administrators and sales staff) when viewing receipts, potentially leading to session hijacking, data theft, or unauthorized actions.
Recommendation
Upgrade opensourcepos to version 3.4.2, which includes a fix by escaping the output using the esc() function. As a temporary measure, ensure the "Return Policy" field contains only plain text without HTML tags.
Other vulnerabilities in Open Source Point of Sale
See all- CVE-2026-19895Low
In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.
- CVE-2026-32712Medium
Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.
- CVE-2026-39380Medium
Stored XSS vulnerability in Open Source Point of Sale before version 3.4.3. Insufficient input sanitization in the stock_location parameter allows injection of malicious JavaScript that executes in the Employees interface.
- CVE-2025-66924Medium
A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
- CVE-2025-66923High
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
- CVE-2025-66921High
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
Original NVD description (English source)
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts. An attacker with access to the "Store Configuration" (such as a rogue administrator or an account compromised via the separate CSRF vulnerability) can inject malicious JavaScript payloads into this field. These payloads are executed in the browser of any user (including other administrators and sales staff) whenever they view a receipt or complete a transaction. This can lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim. The vulnerability has been patched in version 3.4.2 by ensuring the output is escaped using the `esc()` function in the receipt template. As a temporary mitigation, administrators should ensure the "Return Policy" field contains only plain text and strictly avoid entering any HTML tags. There is no code-based workaround other than applying the patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS