What is the CVSS score of CVE-2026-39380?

CVE-2026-39380 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-39380?

Yes, a patch is available for CVE-2026-39380. Update the affected software to the latest version immediately.

PHP CVE-2026-39380

EUVD-2026-19916 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

XSS PHP

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.4.3

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19916

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:49 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.

AnalysisAI

Stored cross-site scripting in Open Source Point of Sale allows authenticated users to inject malicious JavaScript through the Stock Locations configuration feature, which executes when rendered in the Employees interface. Versions prior to 3.4.3 are affected. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk in multi-user POS environments where administrative interfaces may be accessible to untrusted staff.

Technical ContextAI

The vulnerability exists in the Stock Locations configuration module of Open Source Point of Sale, a PHP web application built on the CodeIgniter framework. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize the stock_location parameter before storing it in the database. When this unsanitized input is later rendered in the Employees interface, the browser executes any embedded JavaScript. This is a classic stored XSS attack vector where untrusted data flows from user input through database storage to output without encoding, violating output encoding principles in web application security.

RemediationAI

Upgrade Open Source Point of Sale to version 3.4.3 or later, which resolves the input sanitization issue in the Stock Locations configuration feature. If immediate upgrade is not feasible, implement input validation and output encoding controls at the application layer to sanitize the stock_location parameter before database storage and HTML-encode all output in the Employees interface. Additionally, restrict access to the Stock Locations configuration feature to trusted administrative users only, reducing the attack surface to authenticated insiders. Refer to the GitHub security advisory at https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg for additional details.