{"id":"CVE-2025-41011","title":"HTML injection vulnerability in PHP Point of Sale v19.4","summary":"HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_cu…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"phppointofsale","product":"php_point_of_sale","affected":["php_point_of_sale = 19.4"],"published":"2026-04-21","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-41011","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/html-injection-php-point-sale-0","label":"cve-coordination@incibe.es"}],"tags":["nvd"],"epss":0.00158,"epssPercentile":0.0443,"ingestedAt":"2026-10-14T13:30:58.481Z","slug":"CVE-2025-41011","body":"## Overview\n\nHTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.\n\n## Affected\n\n- `php_point_of_sale = 19.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}