PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32712 opensourcepos CVE debrief

CVE-2026-32712 is a Stored Cross-Site Scripting (XSS) vulnerability in Open Source Point of Sale (3.4.2 and earlier). The vulnerability exists in the Daily Sales management table, where the customer_name column is configured with escape: false, causing customer names to be rendered as raw HTML. An attacker with customer management permissions can inject arbitrary JavaScript into a customer's first_name or last_name field, which executes in the browser of any user viewing the Daily Sales page. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. Users of Open Source Point of Sale (3.4.2 and earlier) should apply the patch in version 3.4.3 to prevent XSS attacks.

Vendor
opensourcepos
Product
Unknown
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Users of Open Source Point of Sale (3.4.2 and earlier) should apply the patch in version 3.4.3 to prevent XSS attacks. Operators, platform administrators, vulnerability management teams, and security teams should review and prioritize this vulnerability based on exposure and potential impact.

Technical summary

The vulnerability exists due to the customer_name column being configured with escape: false in the bootstrap-table column configuration. This allows an attacker to inject arbitrary JavaScript into a customer's first_name or last_name field, which is then executed in the browser of any user viewing the Daily Sales page. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. Affected product context indicates Open Source Point of Sale versions 3.4.2 and earlier are vulnerable.

Defensive priority

Apply the patch in version 3.4.3 to prevent XSS attacks. Restrict customer management permissions and monitor for suspicious activity on the Daily Sales page.

Recommended defensive actions

  • Apply the patch in version 3.4.3
  • Restrict customer management permissions
  • Monitor for suspicious activity on the Daily Sales page
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-07T21:17:16.430Z and last modified on 2026-07-24T23:10:00.563Z. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD information. Defenders should verify Open Source Point of Sale version and patch status.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32712 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32712

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32712 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32712

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.