Search

Find a vulnerability

Search criteria

    4 vulnerabilities by Sipay Electronic Money and Payment Services Inc.

    CVE-2026-86405 (GCVE-0-2026-86405)

    Vulnerability from nvd – Published: 2026-10-09 12:52 – Updated: 2026-10-09 12:52
    VLAI
    Title
    Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
    Summary
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-347 - Improper verification of cryptographic signature
    Assigner
    TR-CERT CNA under the mitre root
    CNA scorecard C 74/100 over 260 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-10-09 12:47
    Credits
    Yasin SUER
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PrestaShop Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:52:43.902Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1287"
        }
      ],
      "source": {
        "advisory": "TR-26-1287",
        "defect": [
          "TR-26-1287"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s SanalPos PrestaShop",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-86405",
    "datePublished": "2026-10-09T12:52:43.902Z",
    "dateReserved": "2026-09-07T11:25:25.549Z",
    "dateUpdated": "2026-10-09T12:52:43.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-85531 (GCVE-0-2026-85531)

    Vulnerability from nvd – Published: 2026-10-09 12:28 – Updated: 2026-10-09 12:28
    VLAI
    Title
    Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
    Summary
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-347 - Improper verification of cryptographic signature
    Assigner
    TR-CERT CNA under the mitre root
    CNA scorecard C 74/100 over 260 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-10-09 12:01
    Credits
    Yasin SUER
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenCart Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:28:54.969Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1286"
        }
      ],
      "source": {
        "advisory": "TR-26-1286",
        "defect": [
          "TR-26-1286"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s OpenCart 3.x",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85531",
    "datePublished": "2026-10-09T12:28:54.969Z",
    "dateReserved": "2026-09-04T08:44:49.198Z",
    "dateUpdated": "2026-10-09T12:28:54.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-86405 (GCVE-0-2026-86405)

    Vulnerability from cvelistv5 – Published: 2026-10-09 12:52 – Updated: 2026-10-09 12:52
    VLAI
    Title
    Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
    Summary
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-347 - Improper verification of cryptographic signature
    Assigner
    TR-CERT CNA under the mitre root
    CNA scorecard C 74/100 over 260 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-10-09 12:47
    Credits
    Yasin SUER
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PrestaShop Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:52:43.902Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1287"
        }
      ],
      "source": {
        "advisory": "TR-26-1287",
        "defect": [
          "TR-26-1287"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s SanalPos PrestaShop",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-86405",
    "datePublished": "2026-10-09T12:52:43.902Z",
    "dateReserved": "2026-09-07T11:25:25.549Z",
    "dateUpdated": "2026-10-09T12:52:43.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-85531 (GCVE-0-2026-85531)

    Vulnerability from cvelistv5 – Published: 2026-10-09 12:28 – Updated: 2026-10-09 12:28
    VLAI
    Title
    Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
    Summary
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-347 - Improper verification of cryptographic signature
    Assigner
    TR-CERT CNA under the mitre root
    CNA scorecard C 74/100 over 260 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-10-09 12:01
    Credits
    Yasin SUER
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenCart Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:28:54.969Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1286"
        }
      ],
      "source": {
        "advisory": "TR-26-1286",
        "defect": [
          "TR-26-1286"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s OpenCart 3.x",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85531",
    "datePublished": "2026-10-09T12:28:54.969Z",
    "dateReserved": "2026-09-04T08:44:49.198Z",
    "dateUpdated": "2026-10-09T12:28:54.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}