{“lastseen”:”2026-05-04T15:32:40″,”description”:”The administrative panel in UltimatePOS version 4.8 suffers from a persistent cross site scripting vulnerability…”,”published”:”2026-05-04T00:00:00″,”modified”:”2026-05-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 UltimatePOS 4.8 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220281″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-40980″,”CVE-2025-60503″],”sourceData”:”# CVE-2025-60503 \u2014 Stored Cross-Site Scripting (XSS) in UltimatePOS (UltimateFosters) v4.8\\n \\n **Publication date:** 2025-10-30 \\n **CVE ID:** CVE-2025-60503 *(RESERVED)* \\n **Researcher:** Vivien Lebas \\n **Vendor:** UltimateFosters \\n **Product:** [UltimatePOS](https:\/\/codecanyon.net\/item\/ultimate-pos-stock-management-point-of-sale-application\/21216332) \\n **Affected version:** 4.8 \\n **Vulnerability type:** Stored Cross-Site Scripting (XSS) \\n **Severity:** High \\n \\n —\\n \\n ## Overview\\n \\n A **Stored XSS** vulnerability exists in the **UltimatePOS** admin panel (v4.8). \\n The `Reference No.` field in the **Purchases** module accepts unsanitized user input, which is later rendered without proper escaping in the **Reports \u2192 Activity Log** page.\\n \\n This allows an attacker with admin access to execute arbitrary JavaScript in the context of another administrator\u2019s browser session.\\n \\n —\\n \\n ## Affected components\\n \\n Purchases \u2192 List Purchases \u2192 + Add\\n Reports \u2192 Activity Log\\n \\n \\n —\\n \\n ## Technical details\\n \\n When adding a new purchase, the `Reference No.` field value is stored directly and then reflected in the activity log view. \\n Because the output is not escaped, any embedded HTML\/JavaScript executes when the log is viewed.\\n \\n —\\n \\n ## Proof of Concept (PoC)\\n \\n \\u003e \u26a0\ufe0f **For testing purposes only** \u2013 do not use this PoC on production systems.\\n \\n 1. Log in as an administrator \\n 2. Navigate to: \\n \\n Purchases \u2192 List Purchases \u2192 + Add\\n \\n 3. In the **Reference No.** field, insert:\\n \\n `\\u003cscript\\u003ealert(‘XSS’)\\u003c\/script\\u003e`\\n \\n Fill all required fields, then click Save\\n Navigate to:\\n Reports \u2192 Activity Log\\n The alert box appears \u2014 JavaScript executed successfully (stored XSS confirmed)\\n \\n Impact\\n Impact\\tDescription\\n Code execution\\tArbitrary JS runs in the admin browser context\\n Session hijacking\\tAttacker may steal session tokens\\n Data theft\\tExfiltration of sensitive admin data possible\\n Phishing\\tFake UI overlays or redirection attacks possible\\n Mitigation \\u0026 Recommendations\\n \\n For vendor:\\n \\n Sanitize and validate all user input (especially Reference No.)\\n \\n Encode output before rendering dynamic values in HTML\\n \\n Enforce Content Security Policy (CSP) headers\\n \\n Secure cookies (HttpOnly, SameSite=strict)\\n \\n For users:\\n \\n Restrict admin access to trusted users\\n \\n Avoid shared admin accounts\\n \\n Monitor activity logs for suspicious payloads\\n \\n Apply patches immediately once vendor releases them\\n \\n \\n \\n \\n Credits\\n \\n Researcher: Vivien Lebas\\n \\n CVE ID: CVE-2025-60503\\n \\n Product: UltimatePOS by UltimateFosters\\n References\\n \\n Vendor: https:\/\/ultimatefosters.com\\n \\n Product listing: UltimatePOS (CodeCanyon #21216332)\\n \\n CVE entry (pending): CVE-2025-60503 \u2014 RESERVED\\n \\n Note: This vulnerability differs from CVE-2025-40980, which affects a different component of the same product.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220281″,”cvss”:{“score”:8.7,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220281\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-04T15:32:40″,”description”:”The administrative panel in UltimatePOS version 4.8 suffers from a persistent cross site scripting vulnerability…”,”published”:”2026-05-04T00:00:00″,”modified”:”2026-05-04T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 UltimatePOS 4.8 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:220281″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-40980″,”CVE-2025-60503″],”sourceData”:”# CVE-2025-60503 \u2014 Stored Cross-Site Scripting…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,19,12,15,13,53,7,11,5],"class_list":["post-51238","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-87","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n