Abacre vulnerabilities
Published CVEs affecting Abacre products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-67263
Medium · 6.1
CWE-79 Jan 20, 2026
Cross-site Scripting (XSS) in Abacre Retail Point Of Sale
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, persisted in the database.
CVE-2025-67261
Medium · 6.5
CWE-89 Jan 20, 2026
SQL Injection in Abacre Retail Point Of Sale
Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page.
CVE-2025-65320
High · 7.5
CWE-312 Dec 3, 2025
Cleartext Storage of Sensitive Information in Abacre Restaurant Point Of Sale
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt.