CVE-2026-118377

The mews/pos software (up to version 2.0.0 ) is vulnerable to an insufficient verification of data authenticity (CWE-345) in its 3D Pay and 3D Host handlers. Specifically, the GarantiPos , PayForPos , and InterPos handlers fail to invoke the check3DHash() function. This allows unauthenticated att...