Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

OpenCart Virtual POS Module allows fraudulent payment signatures

CVE-2026-85531 · published 14 days ago
Summary

The OpenCart Virtual POS Module from Sipay Electronic Money does not correctly verify digital signatures on payment messages. As a result, an attacker could forge signatures and make the system accept false payment confirmations. Update the module to version 26.9.1 or later to fix the validation logic.

What to do
  • Update sipay electronic money and payment services inc. opencart virtual pos module to version 26.9.1 or later.
Affected software
VendorProductAffected versions
sipay electronic money and payment services inc. opencart virtual pos module < 26.9.1
Original advisory text
Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.

This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published9 Oct 2026
Updated22 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-85531 · NVD
CVE-2026-85531 · MITRE
Track software like this
Free during beta