EUVD-2026-57170
GHSA-g7w2-c4cm-5hf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authenticated attacker delivers stored XSS over network requiring admin interaction; scope changes to admin session justifying S:C, C:L, I:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.
AnalysisAI
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
Ultimate POS is a PHP-based point-of-sale and stock management web application distributed commercially via CodeCanyon (CPE: cpe:2.3:a:ultimate_fosters:ultimate_pos_(stock_management_&_point_of_sale):*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input in the first-name field is persisted to the database without server-side sanitization or HTML output encoding, and later reflected verbatim into the HTML rendering context of the HRM/Leave module's notification pane. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) precisely describes the attack surface: network reachable, low complexity, low-privilege required, but contingent on active interaction by a privileged user who opens the notification view. The subsequent-system impact metrics (SC:L/SI:L) capture the cross-user escalation from a Cashier-role session into an admin-origin session.
RemediationAI
No vendor-released patch with a confirmed fixed version number has been identified at the time of this analysis. Organizations running Ultimate POS version 7.2 or earlier should actively monitor the CodeCanyon product listing (https://codecanyon.net/item/ultimate-pos-stock-management-point-of-sale-application/21216332) and the VulnCheck advisory (https://www.vulncheck.com/advisories/ultimate-pos-stored-xss-via-first-name-field-in-leave-notifications) for an updated release. As an immediate compensating control, administrators should restrict access to the HRM/Leave module to only trusted personnel, reducing the pool of authenticated users who can submit leave requests and trigger the stored payload - note this may affect legitimate HR workflows. Deploying a Content Security Policy (CSP) header that disallows inline script execution ('unsafe-inline') will prevent injected scripts from running even if the payload is stored, though overly restrictive CSP may break legitimate application JavaScript and requires functional testing before production deployment. A WAF rule blocking HTML-special characters (angle brackets, script tags) in the first-name field at the application boundary provides an additional stop-gap, with the caveat that it may reject legitimate names containing certain Unicode or punctuation characters.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today