CVE-2026-39380: opensourcepos open source point of sale

csirt@kutim:~/threat-intel/cve/CVE-2026-39380

CVSS 5.4 · Medium EPSS 0,24%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada opensourcepos open source point of sale. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.

Rincian

Terbit di NVD: 7 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
opensourcepos	open source point of sale	Semua versi sebelum 3.4.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg exploit · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.