CVE-2026-32712

OVERVIEW CVE-2026-32712 is a Stored Cross-Site Scripting (XSS) vulnerability in Open Source Point of Sale (OSPOS) versions prior to 3.4.3. The vulnerability exists in the Daily Sales management table where the customer_name column fails to properly escape HTML characters. An attacker with customer management permissions can inject malicious JavaScript code into customer first_name or last_name fields, which then executes in the browsers of any user accessing the Daily Sales page. This affects the CodeIgniter-based PHP application. SEVERITY The vulnerability carries a CVSS v3.1 score of 5.4 (Medium), reflecting its network-accessible nature with low attack complexity and low privileges required. However, successful exploitation requires user interaction and assumes the attacker already possesses customer management permissions, limiting the overall threat scope. The attack impacts confidentiality and integrity through potential data theft or manipulation rather than system availability. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00025 is exceptionally low, placing it in the lowest percentile of vulnerability exploitation likelihood among all published CVEs. Community attention remains minimal, and no publicly available exploit code has been widely distributed. Organizations should prioritize patching based on asset criticality rather than immediate exploitation risk.