Improper Input Validation in PayTR Payment iFrame API
CVE-2026-16025

7.5HIGH

Key Information:

Vendor: Paytr Payment And Electronic Money Institution Inc.
Status: Paytr Virtual Pos Iframe Api (v9x) Whmcs Module
Vendor: CVE Published:; 8 September 2026

🔔 Create Paytr Payment And Electronic Money Institution Inc. Vulnerability Alert

What is CVE-2026-16025?

An improper validation issue exists in the PayTR Virtual Pos iFrame API WHMCS Module, specifically in versions from v9.0.0 before v9.0.3. This vulnerability allows attackers to manipulate input data by exploiting the way quantity is validated, potentially leading to unexpected behavior or data integrity issues.

Affected Version(s)

PayTR Virtual Pos iFrame API (v9x) WHMCS Module v9.0.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/...

government-resource

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 8, 2026
Vulnerability Reserved
Jul 17, 2026

Credit

Efe KIRBAŞ

CVE-2026-16025 Data

JSON