CVE-2026-16272

CriticalCVSS 9.1/10Last modified Oct 1, 2026

Description

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers.

This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-348

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2026
Last modified
Oct 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-162734.6The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when reCVE-2026-162742.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a postCVE-2026-162755.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 thCVE-2026-162762.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store reCVE-2026-162776.5A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address infoCVE-2026-162799.3An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026CVE-2026-16284.6Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which aCVE-2026-162809.8An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs largeCVE-2026-162817.1The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI imagCVE-2026-162825.3The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side confiCVE-2026-162857.5The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media libraryCVE-2026-162869.8Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade
CVE-2026-16272: Critical severity, CVSS 9.1 | Vulnix