CVE-2021-47908
Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability through product add or edit functions to execute arbitrary JavaScript and potentially hijack user sessions.
- Affected products
- Ultimatepos
- Fix
- Available
- CVSS 3.1
- 6.4 MEDIUM
- EPSS
- 0.3% (24th percentile)
- Weakness
- CWE-79
- NVD status
- Deferred
- Published
- 2026-02-01
CVE-2021-47908 at NVD
No indexed exploits for CVE-2021-47908 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-47908 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.