CVE-2026-26745

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-26745

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26745.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-26745

Published

2026-02-20T00:00:00Z

Modified

2026-07-15T01:49:03.406476643Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currencysymbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26745.json"
}

References

Affected packages

Git / github.com/opensourcepos/opensourcepos

Affected ranges

Type

GIT

Repo

https://github.com/opensourcepos/opensourcepos

Events

Introduced

5f395d987b02562092b838073cb2e23a22d2bca4

Last affected

5f395d987b02562092b838073cb2e23a22d2bca4

Database specific

{
    "cpe": "cpe:2.3:a:opensourcepos:open_source_point_of_sale:3.4.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.4.1"
        },
        {
            "last_affected": "3.4.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26745.json"