https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32712.htmlhttps://patchthecve.com/cve/CVE-2026-32712.htmlFri, 24 Jul 2026 23:10:00 +0000MEDIUM 5.4: Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Daily Sales management table. The customer_name column is configured with escape: false in the bootstrap-tablhttps://patchthecve.com/cve/CVE-2026-39380.htmlhttps://patchthecve.com/cve/CVE-2026-39380.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 5.4: Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied throughhttps://patchthecve.com/cve/CVE-2026-33730.htmlhttps://patchthecve.com/cve/CVE-2026-33730.htmlWed, 17 Jun 2026 10:38:00 +0000MEDIUM 6.5: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated low-privileged user to access the password change functionality of o