CVE-2026-8803

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8803", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-18T04:37:54.529Z", "datePublished": "2026-05-18T11:30:08.931Z", "dateUpdated": "2026-05-19T16:20:03.549Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-18T11:30:08.931Z"}, "title": "opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-328", "lang": "en", "description": "Use of Weak Hash"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "opensourcepos", "product": "Open Source Point of Sale", "versions": [{"version": "3.4.0", "status": "affected"}, {"version": "3.4.1", "status": "affected"}, {"version": "3.4.2", "status": "affected"}], "cpes": ["cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"], "modules": ["Employee Login"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: \"[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-18T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-18T06:43:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Kamran Saifullah (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/364436", "name": "VDB-364436 | opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364436/cti", "name": "VDB-364436 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/802561", "name": "Submit #802561 | opensourcepos Open Source Point of Sale 3.4.1 Weak Encoding for Password", "tags": ["third-party-advisory"]}], "tags": ["disputed"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T16:19:49.176036Z", "id": "CVE-2026-8803", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T16:20:03.549Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8803", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T16:19:49.176036Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T16:19:56.512Z"}}], "cna": {"tags": ["disputed"], "title": "opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash", "credits": [{"lang": "en", "type": "reporter", "value": "Kamran Saifullah (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"], "vendor": "opensourcepos", "modules": ["Employee Login"], "product": "Open Source Point of Sale", "versions": [{"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.4.1"}, {"status": "affected", "version": "3.4.2"}]}], "timeline": [{"lang": "en", "time": "2026-05-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-18T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-18T06:43:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/364436", "name": "VDB-364436 | opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364436/cti", "name": "VDB-364436 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/802561", "name": "Submit #802561 | opensourcepos Open Source Point of Sale 3.4.1 Weak Encoding for Password", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: \"[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "Use of Weak Hash"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-18T11:30:08.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8803", "state": "PUBLISHED", "dateUpdated": "2026-05-19T16:20:03.549Z", "dateReserved": "2026-05-18T04:37:54.529Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-18T11:30:08.931Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"], "modules": ["Employee Login"], "product": "Open Source Point of Sale", "vendor": "opensourcepos", "versions": [{"status": "affected", "version": "3.4.0"}, {"status": "affected", "version": "3.4.1"}, {"status": "affected", "version": "3.4.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: \"[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function.\""}, {"lang": "es", "value": "Se ha encontrado una falla en opensourcepos Open Source Point of Sale hasta la versi\u00f3n 3.4.2. Se ve afectada la funci\u00f3n Login del archivo app/Models/Employee.PHP del componente Employee Login. Esta manipulaci\u00f3n provoca el uso de un hash d\u00e9bil. La explotaci\u00f3n remota del ataque es posible. Se considera que el ataque tiene una complejidad alta. La explotabilidad se considera dif\u00edcil. La existencia real de esta vulnerabilidad est\u00e1 actualmente en cuesti\u00f3n. El proveedor explica: \u2019El c\u00f3digo sigue ah\u00ed para permitir que la ruta de actualizaci\u00f3n funcione. La contrase\u00f1a predeterminada se inicializa con la funci\u00f3n de hash antigua, pero luego se migra a una m\u00e1s nueva despu\u00e9s del inicio de sesi\u00f3n. La verificaci\u00f3n de la versi\u00f3n del hash podr\u00eda limpiarse en el futuro. Actualmente no est\u00e1 en uso activo, ya que cualquier cambio de contrase\u00f1a utilizar\u00e1 una funci\u00f3n de hash m\u00e1s nueva.\u2019"}], "id": "CVE-2026-8803", "lastModified": "2026-10-26T13:10:00.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8803", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T16:19:49.176036Z", "version": "2.0.3"}}]}, "published": "2026-05-18T12:16:17.093", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/802561"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/364436"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/364436/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Open Source Point of Sale", "source": "cna", "vendor": "opensourcepos"}, "product": "open_source_point_of_sale", "vendor": "opensourcepos"}], "created": "2026-05-18T13:30:05.828736+00:00", "updated": "2026-05-18T13:30:06.154849+00:00", "vendors": ["opensourcepos", "opensourcepos$PRODUCT$open_source_point_of_sale"]}