CVE-2026-71803 Details

A stored cross-site scripting vulnerability has been identified in version 1.0 of the Maini POS system. The issue arises when the backend processes return items; it fails to properly filter or escape the 'goodsName' parameter. This unvalidated input is directly added to the order log description, which the frontend then renders using 'v-html'. As a result, an attacker with the ability to create products can inject malicious JavaScript that executes when an administrator views the order logs.

To address this vulnerability, sanitize the 'goodsName' input before logging it, using a method to escape HTML. Alternatively, the frontend can be modified to use standard text interpolation instead of 'v-html', which would prevent the execution of injected scripts.