CVE-2026-26745

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-26745
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md Exploit Mitigation Third Party Advisory
https://github.com/opensourcepos/opensourcepos Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensourcepos:open_source_point_of_sale:3.4.1:*:*:*:*:*:*:*
History

24 Feb 2026, 20:45

Type Values Removed Values Added
CPE cpe:2.3:a:opensourcepos:open_source_point_of_sale:3.4.1:*:*:*:*:*:*:*
Summary
  • (es) OpenSourcePOS 3.4.1 tiene una vulnerabilidad de inyección SQL de segundo orden en el manejo del campo de configuración currency_symbol. Aunque la entrada se almacena inicialmente sin ejecución inmediata, posteriormente se concatena en una consulta SQL construida dinámicamente sin la sanitización o el enlace de parámetros adecuados. Esto permite a un atacante con acceso para modificar el valor de currency_symbol inyectar expresiones SQL arbitrarias, las cuales se ejecutan cuando la consulta afectada es procesada posteriormente.
References () https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md - () https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md - Exploit, Mitigation, Third Party Advisory
References () https://github.com/opensourcepos/opensourcepos - () https://github.com/opensourcepos/opensourcepos - Product
First Time Opensourcepos
Opensourcepos open Source Point Of Sale

23 Feb 2026, 21:19

Type Values Removed Values Added
CWE CWE-89
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

20 Feb 2026, 17:25

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-20 17:25

Updated : 2026-02-24 20:45

NVD link : CVE-2026-26745

Mitre link : CVE-2026-26745

CVE.ORG link : CVE-2026-26745

JSON object : View

Products Affected

opensourcepos

  • open_source_point_of_sale
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')