{"id":"CVE-2026-26745","aliases":["EUVD-2026-7499","GHSA-fqrw-hvqv-r58w"],"status":"published","title":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the...","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00347,"percentile":0.28524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-02-20T00:00:00Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"opensourcepos","product":"open_source_point_of_sale"}],"references":[{"url":"https://github.com/opensourcepos/opensourcepos","tags":["Product","package"]},{"url":"https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26745.md","tags":["Exploit","Mitigation","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26745","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fqrw-hvqv-r58w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26745.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-26745","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","status":"published","published":"2026-02-20T00:00:00Z","modified":"2026-02-23T20:22:06.979Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-7499","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","status":"published","published":"2026-02-20T00:00:00Z","modified":"2026-02-23T20:22:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:32.158773Z"}],"ghsa":[{"id":"GHSA-fqrw-hvqv-r58w","title":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the...","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","status":"published","published":"2026-02-20T18:31:39Z","modified":"2026-02-23T21:32:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:06:20.459119Z"}],"nvd":[{"id":"CVE-2026-26745","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","status":"published","published":"2026-02-20T17:25:55.807Z","modified":"2026-06-17T10:26:19.293Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:06.63895Z"}],"osv":[{"id":"CVE-2026-26745","description":"OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.","status":"published","published":"2026-02-20T00:00:00Z","modified":"2026-10-28T02:30:51.398704723Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:59.80315Z"}]}}