omkaryepre/vulnerability-research

omkaryepre/vulnerability-research

Releases0

Stars1

This repository contains information on the CVEs I found.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-66924 ↗	Dec 17, 2025Wednesday, 17 December 2025, 18:15	6.1 MEDIUM	—
A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
CVE-2025-66923 ↗	Dec 17, 2025Wednesday, 17 December 2025, 18:15	7.2 HIGH	—
A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.
CVE-2025-66921 ↗	Dec 17, 2025Wednesday, 17 December 2025, 17:15	7.2 HIGH	—
A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.
CVE-2025-66918 ↗	Dec 11, 2025Thursday, 11 December 2025, 18:16	8.8 HIGH	—
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
CVE-2025-65358 ↗	Dec 2, 2025Tuesday, 2 December 2025, 17:16	9.8 CRITICAL	—
Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.
CVE-2025-63800 ↗	Nov 18, 2025Tuesday, 18 November 2025, 16:15	7.5 HIGH	—
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.