Medium severity · published Sep 7, 2025
CVE-2025-10066
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dymanic_table.php. Such manipulation of the argument scripts leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
POS Point of Sale System · itsourcecode
1.0 · source: vendor
PO
Point OF Sale System · Facebook-kimmymatillano
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10066
Exploit
https://github.com/AlphabugX/CVE-Report/blob/main/CVE-010.md
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.322989
Third Party Advisory
https://vuldb.com/?id.322989
Third Party Advisory
https://vuldb.com/?submit.643948
More from POS Point of Sale System
6.1
CVE-2025-10067
itsourcecode POS Point of Sale System empty_table.php cross site scripting
6.1
CVE-2025-10065
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
6.1
CVE-2025-10064
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
6.1
CVE-2025-10063
itsourcecode POS Point of Sale System deferred_table.php cross site scripting
6.1
CVE-2025-10029
itsourcecode POS Point of Sale System complex_header_2.php cross site scripting