Open Source POS CVE-2025-66921

Exploitation requires an authenticated account with sufficient privileges to reach the Create/Update Item(s) module of Open Source Point of Sale v3.4.1 (the input CVSS PR:H implies administrator-level access), used to inject the payload via the item 'name' parameter. Because this is XSS, successful impact additionally depends on a second victim user subsequently viewing the page that renders the stored 'name' value, so realistic exploitation hinges on a multi-user deployment where a higher- or differently-privileged user views attacker-controlled item data. These prerequisites - prior authenticated/privileged access plus a victim viewing the injected content - materially limit real-world risk despite the network attack vector.

This is a stored/reflected cross-site scripting flaw rated CVSS 7.2 (High) with the input vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The signals are mixed and some are internally inconsistent. Supporting a moderate-but-not-urgent priority: public exploit code exists (a GitHub write-up), but there is NO CISA KEV listing and the EPSS score is low at 0.55% (45th percentile), indicating no evidence of widespread automated exploitation. Several provided signals conflict and should be treated with caution: (1) The input CWE is CWE-20 (Improper Input Validation), but the description and tags clearly describe XSS (CWE-79) - the CWE appears mislabeled. (2) The input CVSS vector is atypical for XSS: it claims S:U with C:H/I:H/A:H, whereas XSS normally executes in a victim's browser, implying a scope change (S:C) and limited (L) rather than High impacts. The High-triple-impact with Unchanged scope looks over-scored for a 'name'-parameter script injection. (3) PR:H in the vector indicates the attacker already needs high (likely admin) privileges to reach the Create/Update Item(s) module, which substantially limits real-world risk - an attacker who can already administer items has limited incentive to XSS themselves unless targeting lower-privileged staff viewing those items. Net assessment: a genuine but lower-tier issue - a privilege-gated XSS in a niche open-source product with public PoC but no active exploitation evidence. Treat the inflated impact metrics skeptically and verify against the vendor.

An authenticated user with access to the Create/Update Item(s) module submits a product with a malicious script payload in the 'name' field, which is stored without sanitization. When another staff member or administrator later views the item list or detail page, the script executes in their browser session, enabling session-token theft or actions in the victim's authenticated context. Public exploit/PoC documentation for this flaw already exists.