Back to feed
EUVD-2026-7499 · Published Feb 20, 2026
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
Technologies
Opensourcepos Open Source Point Of Sale
Weaknesses
CWE-89
CVSS scores
- v3.15.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
