money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.
CVE-2026-71803
NONE
EPSS 0.16%
Updated Sep 10, 2026
Payload
CVE Details
CVE ID
CVE-2026-71803
Published Date
Sep 10, 2026
Vendor
Payload
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.16%
Likelihood of exploitation in next 30 days
Percentile:
5.8th percentile (higher than 5.8% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory