A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
References
| Link | Resource |
|---|---|
| https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70095.md | Exploit Mitigation Third Party Advisory |
| https://github.com/opensourcepos/opensourcepos | Product |
| https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70095.md | Exploit Mitigation Third Party Advisory |
Configurations
History
17 Feb 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:opensourcepos:open_source_point_of_sale:3.4.1:*:*:*:*:*:*:* | |
| References | () https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70095.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://github.com/opensourcepos/opensourcepos - Product | |
| First Time |
Opensourcepos
Opensourcepos open Source Point Of Sale |
13 Feb 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://github.com/hungnqdz/cve-research/blob/main/CVE-2025-70095.md - | |
| CWE | CWE-79 |
13 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-13 16:16
Updated : 2026-02-17 14:59
NVD link : CVE-2025-70095
Mitre link : CVE-2025-70095
CVE.ORG link : CVE-2025-70095
JSON object : View
Products Affected
opensourcepos
- open_source_point_of_sale
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')