Threats tagged 'ghsa-5gpc-893h-q6v2'

A cross-site scripting (XSS) vulnerability in UltimatePOS 4.8 allows authenticated attackers to inject arbitrary JavaScript via the purchase functionality. The injected script is reflected in the admin log panel's 'reference No.' field without proper escaping, enabling execution in an administrator's browser session. This can lead to session hijacking or other malicious actions.