MEDIUM 4.8 NVD
CVE-2026-70560
Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to injec
Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.
References
- https://codecanyon.net/item/ultimate-pos-stock-management-point-of-sale-application/212163
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-70560
- https://www.vulncheck.com/advisories/ultimate-pos-stored-xss-via-first-name-field-in-leave
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-70560
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-08-12 via NVD.
vulnfeed aggregates 9895 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.