Threats tagged 'ghsa-29vm-h87p-hcp4'

PHP Point of Sale version 19.4 contains an HTML injection vulnerability. This flaw allows attackers to inject and render arbitrary HTML in the victim's browser by exploiting insufficient input validation on the '/reports/generate/specific_customer' endpoint via the 'start_date_formatted' and 'end_date_formatted' parameters. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity.