What is the CVSS score of CVE-2025-70093?

CVE-2025-70093 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Open Source Point Of Sale are affected by CVE-2025-70093?

CVE-2025-70093 affects OpenSourcePOS v3.4.1 and allows remote attackers to execute arbitrary code through malicious AJAX responses, potentially compromising point-of-sale systems and customer data.

Is there a public PoC exploit available for CVE-2025-70093?

Yes, a public proof-of-concept exploit is available for CVE-2025-70093. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-70093?

Within 24 hours: Identify and inventory all OpenSourcePOS v3.4.1 instances; isolate affected systems from production networks if possible and restrict AJAX endpoint access. Within 7 days: Implement Web Application Firewall (WAF) rules to inspect and block suspicious AJAX responses; enable network segmentation to limit lateral movement from compromised POS terminals. Within 30 days: Evaluate alternative POS solutions or contact vendor for patch timeline; conduct forensic analysis for signs of compromise; implement enhanced monitoring for anomalous AJAX traffic and code execution attempts.

Open Source Point Of Sale CVE-2025-70093

HIGH

Command Injection (CWE-77)

2026-02-13 cve@mitre.org

RCE Command Injection Open Source Point Of Sale Opensourcepos

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 17, 2026 - 14:59 vuln.today

Public exploit code

CVE Published

Feb 13, 2026 - 16:16 nvd

HIGH 7.4

DescriptionCVE.org

An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.

AnalysisAI

An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response. [CVSS 7.4 HIGH]

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Open Source Point Of Sale. An issue in OpenSourcePOS v3.4.1 allows attackers to execute arbitrary code via returning a crafted AJAX response.