Open Source POS CVE-2025-66924

The attacker must be able to reach the Create/Update Item Kit(s) workflow and submit the 'name' parameter - a back-office inventory function of Open Source Point of Sale that in a default deployment requires an authenticated operator/admin session, so despite the NVD PR:N label this is effectively an authenticated-write capability. Exploitation further requires a victim user (staff or administrator) to subsequently view the affected item-kit page in their browser (UI:R), making it a stored-XSS condition dependent on both back-office access and later victim interaction; it does not fire against anonymous visitors or without someone opening the poisoned record.

This is a moderate-severity stored/reflected XSS (CVSS 6.1) in a niche open-source product, and the combined signals point to LOW real-world priority rather than an urgent threat. EPSS is low at 0.26% (17th percentile), there is no CISA KEV listing (not actively exploited), and while public POC/write-up code exists on GitHub, POC availability is a distinct and weaker signal than active exploitation. SIGNAL CONFLICT WORTH FLAGGING: the NVD CVSS vector states PR:N (no privileges), yet the vulnerable feature is 'Create/Update Item Kit(s)', a backend inventory-management function of a Point-of-Sale application that normally requires an authenticated operator/admin session - verify with the vendor, as the PR:N rating likely understates the true authentication barrier and overstates reach. Scope is marked Changed (S:C) consistent with XSS executing in a victim's browser context, with only Low confidentiality/integrity impact and no availability impact. Net: a genuine but contained web-app XSS affecting a low-footprint product, appropriate for routine patching rather than emergency response.

An attacker with access to the POS back-office saves a malicious script in the 'name' field of an Item Kit; when a staff member or administrator later opens that item kit in the dashboard, the script executes in their authenticated browser session, enabling session-token theft or actions on their behalf. A public write-up/POC exists on GitHub, lowering the effort to reproduce. Because exploitation requires a victim to view the affected page (UI:R), it is not fully automatic.