Paper/Archive/CVE-2026-85531

CVE-2026-85531

Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module — Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 10.0.100 × 202.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

Affected

ProductAffectedFixed inSource

OpenCart Virtual POS Module26.8.2 – < 26.9.126.9.1CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1286