CVE-2025-41011 HTML injection in PHP Point Of Sale
An attacker can inject HTML into the victim's browser via unvalidated date parameters in the customer report feature of PHP Point of Sale.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-41011?
CVE-2025-41011 is a medium-severity cross-site scripting vulnerability in PHP Point Of Sale, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.
Weakness: CWE-79
Which versions are affected by CVE-2025-41011?
It affects 1 product.
Products include Phppointofsale Php Point of Sale.
How do I fix CVE-2025-41011?
No fix has been published for CVE-2025-41011 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-41011 being exploited?
There is no known exploitation of CVE-2025-41011 in the wild and no public exploit code.
Other vulnerabilities in PHP Point Of Sale
- CVE-2022-40293 Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
- CVE-2022-40296 Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.
- CVE-2022-40287 Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.
- CVE-2022-40288 Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality
- CVE-2022-40289 Cross-site scripting in PHP Point of Sale
Sources
Also known as GHSA-29vm-h87p-hcp4.