CVE-2025-41011

CVE-2025-41011 is an HTML injection vulnerability affecting PHP Point of Sale version 19.4, where insufficient input validation on the '/reports/generate/specific_customer' endpoint allows attackers to inject and render arbitrary HTML in victims' browsers through the 'start_date_formatted' and 'end_date_formatted' parameters. The vulnerability carries a FAUCET Risk Score of 32.0/100 with a low EPSS score of 0.00047, indicating minimal statistical likelihood of exploitation relative to other vulnerabilities. The attack requires minimal complexity and likely involves network-based access, though precise CVSS metrics are currently unavailable. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence watch lists, with no confirmed public exploit code or widespread community attention at this time. Organizations using PHP Point of Sale v19.4 should implement input sanitization controls and consider upgrading to patched versions as they become available, though immediate exploitation risk appears low based on available indicators.