What’s Vulnerable › Vulnerabilities
CVE-2026-85531: Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-09 · updated 2026-10-12
- Weakness: CWE-347
Description
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
Affected products
- Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module: from 26.8.2 before 26.9.1 — fixed in 26.9.1
How to fix
Upgrade to a fixed version: Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module 26.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85531 or the next vulnerability affects your stack