Ultimate Pos Stock Management Point Of Sale
Monthly
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.