EIP-2026-112885
PRE-CVEUltimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-112885. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary This is a proof-of-concept for a persistent XSS vulnerability in Ultimate POS 4.4, where the 'name' parameter in the product module is vulnerable to script injection. The exploit demonstrates how an attacker with vendor privileges can inject malicious JavaScript payloads via POST requests.
Description
Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
Exploits (1)
This is a proof-of-concept for a persistent XSS vulnerability in Ultimate POS 4.4, where the 'name' parameter in the product module is vulnerable to script injection. The exploit demonstrates how an attacker with vendor privileges can inject malicious JavaScript payloads via POST requests.