A vulnerability in earlier releases of Open Source Point of Sale permits the injection of arbitrary JavaScript code through the stock_location parameter. The input is stored in the database without proper sanitization and later rendered in the Employees view. An attacker who can submit such a payload can cause browsers of users who view the affected page to execute the script, potentially stealing session cookies or manipulating the interface.

Any installation of Open Source Point of Sale older than version 3.4.3 is affected. The specific vendor is Open Source POS and the product is its web‑based point‑of‑sale application. The vulnerability manifests in the Stock Locations configuration screen, accessed through the web interface.

The CVSS score of 5.4 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves authenticated access to the configuration interface, but if the application is exposed to unauthenticated users, remote exploitation is possible. Attackers could achieve script execution in the context of legitimate users, compromising confidentiality and integrity of sensitive data.