CVE-2026-118377Published
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118377 · Microsoft / collected KEV context
cve-program · CVE-2026-118377
- https://github.com/mewebstudio/pos/pull/305
- https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a
- https://github.com/mewebstudio/pos/issues/306
- https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L135-L150
- https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L134-L149
- https://github.com/mewebstudio/pos
- https://www.vulncheck.com/advisories/mews-pos-through-2.0.0-missing-hash-verification-in-3d-pay-and-3d-host-callbacks
Related operational evidence
Explicit CVE identifiers- mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks · Newly collected advisory · 28 Oct 2026