CVE-2026-16025
HighCVSS 7.5Summary
Improper validation of specified quantity in input vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation. Affects versions from v9.0.0 before v9.0.3.
Risk Assessment
An attacker can manipulate input data, potentially leading to incorrect transaction processing, such as changing quantities or amounts, which could result in financial losses.
Recommendation
Upgrade the PayTR Virtual Pos iFrame API (v9x) WHMCS Module to version v9.0.3 or later, which includes the validation fix.
Other vulnerabilities in PayTR Virtual Pos iFrame API (v9x) WHMCS Module
See all- CVE-2026-16037High
Observable timing discrepancy vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. Affects versions from v9.0.0 before v9.0.3.
- CVE-2026-16272Critical
Use of less trusted source vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects versions from v9.0.0 before v9.0.3.
Original NVD description (English source)
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.