Medium severity · published Sep 7, 2025
CVE-2025-10064
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_two_headers.php. The manipulation of the argument scripts results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
POS Point of Sale System · itsourcecode
1.0 · source: vendor
PO
Point OF Sale System · Facebook-kimmymatillano
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10064
Exploit
https://github.com/AlphabugX/CVE-Report/blob/main/CVE-008.md
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.322987
Third Party Advisory
https://vuldb.com/?id.322987
Third Party Advisory
https://vuldb.com/?submit.643946
More from POS Point of Sale System
6.1
CVE-2025-10067
itsourcecode POS Point of Sale System empty_table.php cross site scripting
6.1
CVE-2025-10066
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
6.1
CVE-2025-10065
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
6.1
CVE-2025-10063
itsourcecode POS Point of Sale System deferred_table.php cross site scripting
6.1
CVE-2025-10029
itsourcecode POS Point of Sale System complex_header_2.php cross site scripting