CVE-2026-32888Disclosure(opensourcepos / open_source_point_of_sale)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute arbitrary SQL queries. A patch did not exist at the time of publication.

opensourcepos CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-hmjv-wm3j-pfhw

Exploit / PoC references

https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-hmjv-wm3j-pfhw

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

open_source_point_of_sale

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-20); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

opensourcepos

Products

open_source_point_of_sale

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	3	Disclosure2General1
2026-03-22	1	Disclosure1

Full discourse4 posts

The Hacker Wire@TheHackerWire202d
Disclosure
🟠 CVE-2026-32888 - High Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the cu... https://www.thehackerwire.com/vulnerability/CVE-2026-32888/ https://t.co/bFyZbGjZz9
Post summary
The post announces CVE-2026-32888, a high‑severity SQL injection vulnerability in the Open Source Point of Sale application, providing basic technical details but no exploit, patch, or in‑the‑wild evidence.
0000043
142 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds204d
General
CVE-2026-32888 SQL Injection in Open Source Point of Sale via Unsanitized Custom Attribute Search https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32888
Post summary
The post announces a SQL Injection vulnerability (CVE-2026-32888) in an open‑source POS system, but offers no PoC, exploit code, patch, or evidence of active exploitation.
0000036
4.0K followersView on X
CVE@CVEnew204d
Disclosure
CVE-2026-32888 Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search f… https://www.cve.org/CVERecord?id=CVE-2026-32888
Post summary
CVE-2026-32888 is a disclosed SQL Injection flaw in the Open Source Point of Sale application built on CodeIgniter, affecting the Items search feature, with no PoC or active exploitation details in the provided text.
0000063
56.8K followersView on X
CVEFind.com@CveFindCom204d
Disclosure
[CVE-2026-32888: HIGH] Web-based Point of Sale app has an SQL Injection flaw in custom attribute search function, allowing attackers to execute arbitrary SQL queries. No patch available currently.#cve,CVE-2026-32888,#cybersecurity https://cvefind.com/CVE-2026-32888
Post summary
A newly disclosed SQL injection vulnerability (CVE-2026-32888) in a web‑based Point of Sale application allows attackers to execute arbitrary SQL queries; no patch is currently available.
0000033
604 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	opensourcepos	open_source_point_of_sale	-	-	-

Explore more

Back to dashboard opensourcepos CVEs open_source_point_of_sale vulnerabilities

What researchers are saying

CVE-2026-32888

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-32888, a high‑severity SQL injection vulnerability in the Open Source Point of Sale application, providing basic technical details but no exploit, patch, or in‑the‑wild evidence.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post announces a SQL Injection vulnerability (CVE-2026-32888) in an open‑source POS system, but offers no PoC, exploit code, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

CVE-2026-32888 is a disclosed SQL Injection flaw in the Open Source Point of Sale application built on CodeIgniter, affecting the Items search feature, with no PoC or active exploitation details in the provided text.

CVEFind.com@CveFindComDisclosure

A newly disclosed SQL injection vulnerability (CVE-2026-32888) in a web‑based Point of Sale application allows attackers to execute arbitrary SQL queries; no patch is currently available.