Medium severity6.1NVD Advisory· Published Apr 21, 2026· Updated May 6, 2026
CVE-2025-41011
CVE-2025-41011
Description
HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.
Affected products
3cpe:2.3:a:phppointofsale:php_point_of_sale:19.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phppointofsale:php_point_of_sale:19.4:*:*:*:*:*:*:*
- (no CPE)range: = 19.4
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0nvdThird Party Advisory
News mentions
0No linked articles in our index yet.