CVE-2026-32888

CVE-2026-32888 is a high-severity SQL Injection vulnerability affecting multiple versions of Open Source Point of Sale, a web-based application built with PHP and CodeIgniter. The flaw exists in the Items search functionality when the custom attribute search feature is enabled. An authenticated attacker with basic item search permissions can exploit this by injecting malicious SQL into the 'search' GET parameter, which is directly interpolated into a HAVING clause without sanitization. With a CVSSv3.1 score of 8.8 (High), successful exploitation allows for arbitrary SQL query execution, leading to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and no patch was available at the time of publication.