Open Source Point of Sale vulnerabilities

In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.

Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.

Stored XSS vulnerability in Open Source Point of Sale before version 3.4.3. Insufficient input sanitization in the stock_location parameter allows injection of malicious JavaScript that executes in the Employees interface.