CVE-2026-71803: XSS
money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is affected by the payload?
Exploitation requires product creation privileges to place a malicious payload in the goodsName parameter. Administrators are affected when they view order logs that render the stored content.
What application behavior makes the payload execute?
During return processing, goodsName is concatenated into the order log description without filtering or escaping. The frontend then renders the description with v-html, allowing injected JavaScript to execute.