CVE-2026-16025
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The PayTR Virtual Pos iFrame API WHMCS Module contains a vulnerability due to improper validation of specified quantity in input, allowing input data manipulation. The issue affects versions from v9.0.0 before v9.0.3.
Risk Assessment
An attacker can manipulate input data, potentially leading to unauthorized changes in payment transactions or other data processed by the module.
Recommendation
Update the PayTR Virtual Pos iFrame API WHMCS Module to version v9.0.3 or later, which includes the fix.
Other vulnerabilities in PayTR Virtual Pos iFrame API WHMCS Module
See all- CVE-2026-16272Critical
A use of less trusted source vulnerability in the PayTR Virtual Pos iFrame API WHMCS Module allows exploitation of trusted identifiers. This issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-16037High
The PayTR Virtual Pos iFrame API WHMCS Module contains an observable timing discrepancy vulnerability, allowing black box reverse engineering. The issue affects versions from v9.0.0 before v9.0.3.
Original NVD description (English source)
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS