Ultimatefosters Ultimatepos — known CVE vulnerabilities

Every CVE whose affected-product data names Ultimatefosters Ultimatepos, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2018-17139 — CVSS 8.8 (high): UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code…
• CVE-2025-60503 — CVSS 8.7 (high): A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted…