An authenticated attacker with high privileges can execute arbitrary web scripts or HTML in the context of the application due to a cross-site scripting vulnerability in Open Source Point of Sale v3.4.1.

This vulnerability is a stored cross-site scripting (XSS) flaw occurring within the Create/Update Item module. An attacker with high-level administrative privileges can leverage the name parameter to inject malicious scripts that execute within the browser of other users.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the user's browser session, potentially leading to session hijacking, unauthorized actions on behalf of other administrators, or the theft of sensitive session data. With a CVSS score of 7.2, the vulnerability is classified as high severity, reflecting the significant risk of integrity and confidentiality loss within the point of sale environment.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the Create/Update Item module to only the most trusted personnel and sanitize all user input before processing.

Proactive Monitoring: Monitor application logs for anomalous entries in the name field of item records and watch for unexpected JavaScript execution or unauthorized redirection attempts by administrative users.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS by restricting the sources from which scripts can be loaded and executed.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher write-up referenced by the CVE record.

Given the high severity and the availability of a public proof-of-concept, organizations should treat this vulnerability with urgency. Administrators must limit access to the affected module immediately and monitor the environment for any signs of script injection until an official vendor patch is released and applied.