Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-86405: PrestaShop Virtual POS Module allows fake payment signatures
CVE-2026-86405 · published 13 days ago
Summary
The PrestaShop Virtual POS extension from Sipay Electronic Money can be tricked into accepting forged payment signatures, letting attackers make payments appear legitimate. This could let unauthorized transactions be processed without detection. Update the module to version 26.9.1 or later, or apply the vendor's patch, and verify that only properly signed payments are accepted.
What to do
- Update sipay electronic money and payment services inc. prestashop virtual pos module to version 26.9.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sipay electronic money and payment services inc. | prestashop virtual pos module | < 26.9.1 |
Original advisory text
Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.
This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
References
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1287 government-resource
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published9 Oct 2026
Updated20 Oct 2026
First seen9 Oct 2026
Track software like this
Free during beta