Medium severity · published Sep 7, 2025
CVE-2025-10067
itsourcecode POS Point of Sale System empty_table.php cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Performing manipulation of the argument scripts results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
POS Point of Sale System · itsourcecode
1.0 · source: vendor
PO
Point OF Sale System · Facebook-kimmymatillano
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10067
Exploit
https://github.com/AlphabugX/CVE-Report/blob/main/CVE-011.md
Product
https://itsourcecode.com/
Permissions Required
https://vuldb.com/?ctiid.322990
Third Party Advisory
https://vuldb.com/?id.322990
Third Party Advisory
https://vuldb.com/?submit.643955
More from POS Point of Sale System
6.1
CVE-2025-10066
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
6.1
CVE-2025-10065
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
6.1
CVE-2025-10064
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
6.1
CVE-2025-10063
itsourcecode POS Point of Sale System deferred_table.php cross site scripting
6.1
CVE-2025-10029
itsourcecode POS Point of Sale System complex_header_2.php cross site scripting