Opensourcepos vulnerabilities
We track 7 vulnerabilities in Opensourcepos products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2026.
Latest Opensourcepos vulnerabilities
- 8.8 High severity
opensourcepos: Improper Neutralization of Special Elements used in an SQL Command
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user
- 8.8 High severity
Open Source Point Of Sale: Unrestricted Upload of File with Dangerous Type
OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file uplo
- 8.8 High severity
opensourcepos: Cross-Site Request Forgery
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's f
- 8.1 High severity
opensourcepos: Improper Neutralization of Input During Web Page Generation
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy"
- 7.2 High severity
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point…
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
- 7.2 High severity
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source…
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
- 7.5 High severity
Open Source Point Of Sale: Weak Password Requirements
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empt