CVE-2026-8803— opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash
Possible ATT&CK Techniques 1AI
T1110 · Brute ForceAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| opensourcepos | Open Source Point of Sale | 3.4.0 | affected |
3.4.1 | affected | ||
3.4.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8803
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
可逆的单向哈希
Source: NVD (National Vulnerability Database)
Vulnerability Title
Open Source Point of Sale 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open Source Point of Sale是opensourcepos开源的一个基于网络的销售点系统。 Open Source Point of Sale 3.4.2及之前版本存在加密问题漏洞，该漏洞源于Employee Login组件中文件app/Models/Employee.php的函数Login导致使用弱哈希，可能允许远程攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opensourcepos | Open Source Point of Sale | 3.4.0 | cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-8803
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8803
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: opensourcepos
- CVE-2026-8802
opensourcepos Open Source Point of Sale Items.php getPicThum - CVE-2026-32712
Open Source Point of Sale has Stored XSS in Customer Name (S - CVE-2026-39380
Open Source Point of Sale has Stored XSS in Stock Location ( - CVE-2026-33730
Open Source Point of Sale has an IDOR in Password Change (Ho - CVE-2026-32888
Open Source Point of Sale is Vulnerable to SQL Injection Thr
Same weakness: CWE-328
- CVE-2026-44582
Next.js: Cache poisoning via collisions in React Server Comp - CVE-2020-37168
Ecommerce Systempay 1.0 Production Key Brute Force - CVE-2026-34527
Sandboxie-Plus EditPassword hash entropy reduced from 160 bi - CVE-2026-7845
chatchat-space Langchain-Chatchat Vision Chat Paste Image di - CVE-2026-7103
code-projects Chat System MD5 Hash update_user.php weak hash
V. Comments for CVE-2026-8803
No comments yet