HTML injection vulnerability in PHP Point of Sale v19.4.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 21, 2026 · NIST NVD

   Detected

   HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.

2. Oct 14, 2026 · NIST NVD

   Updated

   HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'end_date_formatted' parameters.

Affected

• cpe phppointofsale/php point of sale19.4

Sources

• CVE.orgVulnerability recordCVE-2025-41011

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-41011

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-41011

  HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer', ussing 'start_date_formatted' y 'e

  nvd.nist.gov

References

• Third Party Advisory · incibe.es