CVE-2026-39380CWE-79

Open Source Point of Sale has Stored XSS in Stock Location (Configuration)

Medium · published April 7, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-07T19:49Z
EPSS history
Timeline
  • 07 APR 19:49Z
    Open Source Point of Sale has Stored XSS in Stock Location (Configuration)
    cvelistv5