Medium severity · published Jul 31, 2025
CVE-2025-40980
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters
5.1
CVSS
0.5%
EPSS
No
On KEV
Description
A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products/<PRODUCT_ID>/edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her session cookies details.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UL
UltimatePOS · UltimateFosters
6.4; · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40980
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-ultimatepos
More from UltimatePOS
8.8
CVE-2018-17139
UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg…
8.7
CVE-2025-60503
A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is…