Medium severity · published Sep 7, 2025
CVE-2025-10065
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
POS Point of Sale System · itsourcecode
1.0 · source: vendor
PO
Point OF Sale System · Facebook-kimmymatillano
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10065
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10065
Exploit
https://github.com/AlphabugX/CVE-Report/blob/main/CVE-009.md
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.322988
Third Party Advisory
https://vuldb.com/?id.322988
Third Party Advisory
https://vuldb.com/?submit.643947
More from POS Point of Sale System
6.1
CVE-2025-10067
itsourcecode POS Point of Sale System empty_table.php cross site scripting
6.1
CVE-2025-10066
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
6.1
CVE-2025-10064
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
6.1
CVE-2025-10063
itsourcecode POS Point of Sale System deferred_table.php cross site scripting
6.1
CVE-2025-10029
itsourcecode POS Point of Sale System complex_header_2.php cross site scripting