CVE-2026-71803

Deferred Deferred - Pending Action

Stored XSS in Money-POS Order Logs via GoodsName Parameter

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: MITRE

Description

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-71803

EUVD

EUVD-2026-75158

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in money-pos version 1.0. The issue occurs when processing returns. The backend does not properly filter or escape the goodsName parameter, directly inserting it into the order log description. The frontend then renders this content using v-html, which executes any embedded JavaScript code.

Detection Guidance

Check order logs in money-pos 1.0 for any entries containing suspicious JavaScript code or HTML tags in the goodsName parameter. Inspect the frontend rendering of order logs for unexpected script execution.

Impact Analysis

An attacker with product creation privileges can inject malicious JavaScript payloads into order logs. When an administrator views these logs, the injected script executes, potentially allowing unauthorized actions, data theft, or session hijacking on behalf of the administrator.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, non-compliance penalties, and loss of trust due to inadequate security controls.

Mitigation Strategies

Update money-pos to the latest version that patches the XSS vulnerability. Implement input validation and output encoding for the goodsName parameter. Use text-based rendering instead of v-html for untrusted content.

Hi! I’m here to help you understand CVE-2026-71803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70