EUVD-2026-59760
GHSA-qqrv-pprc-rj67
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable login requires no authentication (PR:N); AC:H reflects that credential-guessing success is probabilistic, not deterministic; only low confidentiality impact from credential exposure at the authentication layer.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unbounded authentication attempts against Open Source Point of Sale (versions 3.4.0-3.4.2) allow remote attackers to brute-force user credentials via the login endpoint without triggering any lockout or throttle. The Login::index function in app/Config/Validation/OSPOSRules.php performs no rate limiting on failed authentication attempts, leaving all user accounts exposed to automated credential guessing. Publicly available exploit code exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, and the official upstream project has not yet responded to the responsible disclosure.
Technical ContextAI
Open Source Point of Sale is a PHP-based retail management application built on the CodeIgniter 4 framework. Authentication is handled by the login_check() method in app/Config/Validation/OSPOSRules.php, which validates credentials via the Employee model but, in versions up to 3.4.2, applies no IP-based or account-based throttling before processing password comparison. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts): the application neither counts failed login attempts nor enforces a lockout period, making it trivially automatable to submit unlimited credential pairs. The community-contributed fix (commit 851fc32 in the purnadika fork) introduces CodeIgniter's built-in Services::throttler() to cap attempts at 5 per IP per 60-second window, ordered deliberately before password verification to prevent timing side-channel attacks - a nuance confirmed by the inline CAPTCHA comment in the diff.
RemediationAI
No official vendor-released patch is available at time of analysis - the upstream project (opensourcepos/opensourcepos) has not responded to GitHub issue #4583. A community fix exists as commit 851fc323e517e798b3872a2fa54d2923b85fe04c in the purnadika/opensourcepos fork; administrators can apply this patch manually by adding CodeIgniter's throttler check (5 attempts per IP per 60 seconds) in OSPOSRules.php before password verification. As a compensating control, operators should place the login endpoint behind a reverse proxy or WAF configured to rate-limit POST requests to the login path - for example, nginx's limit_req_zone directive or a cloud WAF rule capping authentication attempts to 10 per minute per IP, accepting the trade-off of potentially blocking legitimate users behind shared NAT. Additionally, enforcing strong password policies (minimum 12 characters, complexity requirements) via the application settings raises the effective cost of brute force substantially. Monitor GitHub issue #4583 at github.com/opensourcepos/opensourcepos/issues/4583 for an official upstream response.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today