What is the CVSS score of EUVD-2026-13498?

EUVD-2026-13498 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-13498?

Open Source Point of Sale systems up to version 3.4.1 contain a high-severity SQL injection vulnerability that allows authenticated users to bypass access controls and extract sensitive data from the…

How to fix or mitigate EUVD-2026-13498?

Within 24 hours: Disable custom attribute search functionality in POS configuration and audit recent access logs for suspicious search queries. Within 7 days: Implement Web Application Firewall rules to block SQL injection patterns in search parameters and conduct inventory of all affected systems. Within 30 days: Evaluate alternative POS solutions or request timeline from vendor for patched release; if remaining on current version, establish compensating controls including database activity monitoring and principle of least privilege for POS service accounts.

PHP EUVD-2026-13498

| CVE-2026-32888 HIGH

SQL Injection (CWE-89)

2026-03-20 security-advisories@github.com

SQLi PHP

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13498

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute arbitrary SQL queries. A patch did not exist at the time of publication.

AnalysisAI

Open Source Point of Sale (opensourcepos) contains a critical SQL Injection vulnerability in the Items search functionality when custom attribute search is enabled. An authenticated attacker with basic item search permissions can execute arbitrary SQL queries by manipulating the search GET parameter, which is directly interpolated into a HAVING clause without sanitization. The vulnerability affects all versions up to and including 3.4.1, carries a CVSS score of 8.8 (High), and had no patch available at the time of publication.

Technical ContextAI

Open Source Point of Sale is a web-based point-of-sale application built with PHP using the CodeIgniter framework. This vulnerability is classified as CWE-89 (SQL Injection), a fundamental flaw where external input is used to construct SQL queries without proper sanitization or parameterization. The specific vulnerability occurs in the search_custom filter feature where user-supplied input from the search GET parameter is directly concatenated into a SQL HAVING clause. According to ENISA EUVD (EUVD-2026-13498), opensourcepos versions 3.4.1 and earlier are affected. The vulnerability demonstrates a classic case of insufficient input validation in database query construction, allowing direct manipulation of SQL logic through untrusted data sources.

RemediationAI

At the time of publication, no patch was available for this vulnerability. Organizations running Open Source Point of Sale 3.4.1 or earlier should monitor the official GitHub security advisory at https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-hmjv-wm3j-pfhw for patch availability and update immediately when released. As an interim mitigation, consider disabling the custom attribute search feature (search_custom filter) if not critical to operations. Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the search GET parameter. Restrict access to the application to trusted IP ranges and enforce strong authentication controls with multi-factor authentication where possible. Review database user permissions to ensure the application account follows the principle of least privilege, limiting potential damage from successful exploitation. Conduct thorough log review for suspicious search queries that may indicate exploitation attempts.