EUVD-2026-72852
GHSA-x832-hch7-hxvh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Quantity input manipulation in a payment module primarily affects transaction integrity; the vendor's A:H/I:N scoring contradicts the 'Input Data Manipulation' label.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation.
This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
AnalysisAI
Input data manipulation in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module versions 9.0.0 through 9.0.2 allows unauthenticated remote attackers to submit improperly validated quantity values during the payment flow, per CVSS PR:N/AV:N/UI:N. CWE-1284 (Improper Validation of Specified Quantity in Input) in a payment gateway context typically enables transaction amount tampering - yet the vendor-assigned CVSS vector scores I:N/A:H, characterizing the impact as primarily availability disruption rather than integrity compromise, a direct contradiction with the 'Input Data Manipulation' label applied to the finding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network access to a WHMCS billing portal with the PayTR Virtual Pos iFrame API (v9x) module installed at versions 9.0.0-9.0.2 and the PayTR payment option reachable during checkout. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates unauthenticated, low-complexity network exploitation with a high availability impact and no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PayTR Virtual Pos iFrame API (v9x) WHMCS Module version 9.0.3 or later, which is the first patched release per the advisory range 'before v9.0.3'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WHMCS deployments using PayTR Virtual Pos v9x and verify installed module versions against 9.0.0-9.0.2; segregate affected payment flows from critical paths where possible and enable Web Application Firewall rules to restrict iFrame API quantity parameters to expected ranges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote
Timing side-channel in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0-v9.0.3) enables unauthenticated remot
Share
External POC / Exploit Code
Leaving vuln.today