CVE-2025-10065

itsourcecode POS Point of Sale System dom_data_th.php cross site scripting

A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Affected

itsourcecode · POS Point of Sale System

CVSS v4.0 VULDB

2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 VULDB

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0 VULDB

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 32nd percentile

Published

2025-09-07

Updated

2025-09-08

Proof-of-concept exploits (1)

• AlphabugX/CVE-Report/blob/main/CVE-009.md0★ · 2025-09-06

Security advisories

• https://vuldb.com/?id.322988
• https://vuldb.com/?submit.643947
• https://itsourcecode.com

References

• CVE Record
• NVD entry

Related

• CVE-2019-6249
• CVE-2025-10026
• CVE-2025-10027
• CVE-2025-10028
• CVE-2025-10029
• CVE-2025-10063