CVE-2026-26745

Published: Feb 20, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.

Affected (1)

Products: Opensourcepos: Open Source Point Of Sale

1 product

Open Source Point Of Sale

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opensourcepos Open Source Point Of Sale	Version 3.4.1

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://github.com/opensourcepos/opensourcepos

Source: cve@mitre.org

Product

Timeline

No history available yet.