CVE-2026-85531

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.

This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-855327.5Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak CVE-2026-855337.6An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to u CVE-2026-855345.9A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data t CVE-2026-855388.3An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required p CVE-2026-85543.1Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce CVE-2026-855408.8DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to rea CVE-2026-855415.4DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary J CVE-2026-855428.8IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated CVE-2026-855434.3Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users CVE-2026-855446.1Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with CVE-2026-855457.1There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their CVE-2026-855468.6MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addSer