Medium severity · published Sep 6, 2025
CVE-2025-10029
itsourcecode POS Point of Sale System complex_header_2.php cross site scripting
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/complex_header_2.php. Performing manipulation of the argument scripts results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
POS Point of Sale System · itsourcecode
1.0 · source: vendor
PO
Point OF Sale System · Facebook-kimmymatillano
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10029
Exploit
https://github.com/AlphabugX/CVE-Report/blob/main/CVE-006.md
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.322744
Third Party Advisory
https://vuldb.com/?id.322744
Third Party Advisory
https://vuldb.com/?submit.643944
More from POS Point of Sale System
6.1
CVE-2025-10067
itsourcecode POS Point of Sale System empty_table.php cross site scripting
6.1
CVE-2025-10066
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
6.1
CVE-2025-10065
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
6.1
CVE-2025-10064
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
6.1
CVE-2025-10063
itsourcecode POS Point of Sale System deferred_table.php cross site scripting