CVE-2026-70560

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-705616.5TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privi CVE-2026-705627.0Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-705638.1Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a n CVE-2026-705647.8Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-705657.0Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.CVE-2026-705667.8Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.CVE-2026-705677.0Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.CVE-2026-705687.0Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.CVE-2026-705697.8Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.CVE-2026-70578.8A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. CVE-2026-705708.1Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine CVE-2026-705718.1Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.