What is the CVSS score of CVE-2026-32712?

CVE-2026-32712 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32712?

Yes, a patch is available for CVE-2026-32712. Update the affected software to the latest version immediately.

PHP CVE-2026-32712

EUVD-2026-19939 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 security-advisories@github.com

XSS PHP

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.4.3

EUVD ID Assigned

Apr 07, 2026 - 21:22 euvd

EUVD-2026-19939

Analysis Generated

Apr 07, 2026 - 21:22 vuln.today

CVE Published

Apr 07, 2026 - 21:17 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured with escape: false in the bootstrap-table column configuration, causing customer names to be rendered as raw HTML. An attacker with customer management permissions can inject arbitrary JavaScript into a customer's first_name or last_name field, which executes in the browser of any user viewing the Daily Sales page. This vulnerability is fixed in 3.4.3.

AnalysisAI

Stored XSS in Open Source Point of Sale versions prior to 3.4.3 allows authenticated users with customer management permissions to inject malicious JavaScript into customer name fields, which executes when any user views the Daily Sales page. The vulnerability stems from the bootstrap-table column configuration explicitly disabling HTML escaping (escape: false) for the customer_name column, enabling arbitrary script execution with cross-site impact. Vendor-released patch: 3.4.3.

Technical ContextAI

Open Source Point of Sale is a PHP web application built on the CodeIgniter framework that uses bootstrap-table for data presentation. The vulnerability exploits a configuration oversight where the customer_name column in the Daily Sales management table is configured with escape: false, which instructs bootstrap-table to render cell content as raw HTML rather than escaping special characters. This allows injection of HTML/JavaScript payloads into the customer's first_name or last_name database fields (CWE-79: Improper Neutralization of Input During Web Page Generation). When any authenticated user navigates to the Daily Sales page, the injected script executes in their browser context with their session privileges, enabling session hijacking, credential theft, or malware delivery. The attack requires initial write access to customer records via the customer management interface, but execution impacts all viewers regardless of their role.

RemediationAI

Upgrade Open Source Point of Sale to version 3.4.3 or later, which fixes the bootstrap-table column configuration by enabling HTML escaping for the customer_name column. Administrators should review GitHub security advisory GHSA-hcfr-9hfv-mcwp at https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-hcfr-9hfv-mcwp for patch details and deployment guidance. As an interim mitigation for organizations unable to immediately patch, restrict customer management permissions to a minimal set of trusted administrators and monitor Daily Sales page access logs for unusual script-like patterns in customer names. Additionally, implement a Web Application Firewall (WAF) rule to block script tags in customer name inputs at the application boundary.