CVE-2025-41011CWE-79cross-site-scripting

CVE-2025-41011

Medium · published April 21, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-21T20:16Z
Affected products (1)
ProductVersionsFixed in
phppointofsale/php_point_of_saleall versions—
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0 · [email protected]
EPSS history
Timeline
  • 21 APR 15:15Z
    HTML injection in PHP Point Of Sale
    cvelistv5