CVE-2026-39380 opensourcepos CVE debrief

Who should care

Users of Open Source Point of Sale prior to version 3.4.3 should apply the patch to prevent exploitation of this Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity. The vulnerability exists in the Stock Locations configuration feature, where user input through the stock_location parameter is not properly sanitized. This allows attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface.

Technical summary

The Open Source Point of Sale application, written in PHP using the CodeIgniter framework, is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the Stock Locations configuration feature, where user input through the stock_location parameter is not properly sanitized. This allows attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. The vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity.

Defensive priority

Medium priority due to the CVSS score of 5.4 and the potential for attackers to inject malicious JavaScript code.

Recommended defensive actions

• Apply the patch to upgrade Open Source Point of Sale to version 3.4.3 or later.
• Review and sanitize user input to prevent similar vulnerabilities.
• Monitor for suspicious activity in the Employees interface.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-04-07T20:16:32.617Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The Open Source Point of Sale application, written in PHP using the CodeIgniter framework, has a Stored Cross-Site Scripting (XSS) vulnerability prior to version 3.4.3. The vulnerability exists in the Stock Locations configuration feature, where user input through the stock_location parameter is not properly sanitized. This allows attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. The vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity. Users of Open Source Point of Sale prior to version 3.4.3 should apply the patch to prevent exploitation of this Stored Cross-Site Scripting (XSS) vulnerability.

Official resources