CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

EUVD-2026-111553

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

MeWebStudio Turkish banks virtual POS package input validation error vulnerability

MeWebStudio has a vulnerability related to input validation in version 2.0.0 and earlier of its virtual POS package for Turkish banks. This vulnerability stems from insufficient data authenticity checks. The 3D Pay and 3D Host processors in GarantiPos, PayForPos, and InterPos bypass the check3DHa...

CVE-2026-118377: mewebstudio pos: mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows…

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...