Ultimate Pos (Stock Management & Point Of Sale)
Approved changes feed: RSS · Atom
cpe:2.3:a:ultimate_fosters:ultimate_pos_(stock_management_&_point_of_sale):*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Ultimate Fosters (e5261243-a779-50af-8a44-2cb0d3762990) |
|---|---|
| Product | Ultimate Pos (Stock Management & Point Of Sale) (578e8a6b-9dd8-5566-80bb-b96201ab8aa7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-70560 |
vulnerable | 2026-09-16 04:33:00.059284 |
Ultimate POS Stored XSS via First Name Field in Leave Notifications
MEDIUM (5.4)
Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.
Published: 2026-08-12T11:17:17.254Z
Updated: 2026-10-01T21:44:59.178Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.