Commerce Paybox
CVE-2026-0750
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIntercept Paybox payment response
-
DeliveryModify transaction parameters
-
ExploitForge cryptographic signature
-
ExecutionBypass authentication check
-
ImpactComplete unauthorized payment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Drupal Commerce Paybox module versions 7.X-1.0 through 7.X-1.5 must be installed and active. Vulnerability exploitable against default Paybox payment processing without additional signature verification layers. Remote unauthenticated attacker can intercept and modify payment responses during transaction completion. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Commerce Paybox versions up to 7.X-1.5. is affected by improper verification of cryptographic signature (CVSS 7.5).
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-347: Improper Verification of Cryptographic Signature) affects Commerce Paybox. Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.
Know when Commerce Paybox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.
Executive ViewAI
A critical cryptographic signature verification flaw in Commerce Paybox (versions up to 7.X-1.5) allows attackers to bypass payment authentication controls, potentially enabling unauthorized transactions and payment fraud. Organizations running affected versions face immediate risk of financial loss and customer data compromise, with active exploits already in the wild.
Implement Web Application Firewall (WAF) rules to inspect and validate cryptographic signatures at the network perimeter; disable Paybox payment processing temporarily until patch is available; enforce strict network segmentation restricting payment system access to trusted IP ranges only; enable transaction-level logging and real-time anomaly detection; consider routing payments through alternative payment gateway during remediation period.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB