Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118377— mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

Quick assessment

Affected

mewebstudio pos

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mews/pos 2.0.0 及以下版本存在数据真实性验证不足的漏洞，允许未认证的攻击者通过提交未经验证的回调来伪造支付结果。其中，GarantiPos、PayForPos 和 InterPos 的 3D Pay 及 3D Host 处理器跳过了检查，致使攻击者能够篡改状态、金额或订单 ID 等字段，从而在未实际付款的情况下完成订单。

CVSS 7.5 · High EPSS 0.18% · P8 Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
mewebstudio	pos	`≤ 2.0.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

Source: CVE Program / CVE List V5

Vulnerability Description

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mewebstudio	pos	0 ~ 2.0.0	-

II. Public POCs for CVE-2026-118377

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118377

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118377 (2)

Vendor Advisories for CVE-2026-118377 (1)

🔗 mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks | Advisories | VulnCheck third-party-advisory

Other References for CVE-2026-118377 (2)

🔗 pos/src/Gateway/InterPos.php at 50ed2bfe4f8980b8b0c47996de571943fa58d7ad · mewebstudio/pos · GitHub Read full article technical-description
🔗 Interpos - 3dpay ve 3dHost icin hash validation kontrolu · Issue #306 · mewebstudio/pos issue-tracking

https://www.cve.org/CVERecord?id=CVE-2026-118377

IV. Related Vulnerabilities

Same weakness: CWE-345