Approved changes feed: RSS · Atom
cpe:2.3:a:mewebstudio:pos:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mewebstudio (192b82ec-fe3f-59d3-a5b0-76803295a6bd) |
|---|---|
| Product | Pos (df1a53c8-c652-597c-a6ea-a3901ea701e3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-118377 |
vulnerable | 2026-11-03 10:17:04.445966 |
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
HIGH (7.5)
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
Published: 2026-10-28T02:03:24.283Z
Updated: 2026-11-04T20:33:09.129Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.