Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 07:25:13 +0000 CVE-2026-118377 — mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks https://db.gcve.eu/vuln/cve-2026-118377 <p><strong>Affected:</strong> mewebstudio pos</p> <p>mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.</p> <p><strong>Affected:</strong> mewebstudio pos</p> <p>mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.</p> https://db.gcve.eu/vuln/cve-2026-118377