VULNERABILITY INTELLIGENCE

CVE-2025-41011

CVSS score6.1 MEDIUM
EPSS probability0.16%
CISA KEVNot currently listed
Published2026-04-21
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.

Weakness classification

  • cve-coordination@incibe.es: CWE-79

Primary references