---
cve: "CVE-2026-16272"
severity: "CRITICAL"
cvss: 9.1
epss: "0.1%"
vendor: "PayTR Payment and Electronic Money Institution Inc."
kev: false
exploited: false
published: "2026-09-09 09:17:10"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-21T10:39:36+02:00"
---

# CVE-2026-16272

> 9.1 CRITICAL

## Beschreibung

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers.

This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

## CNA-Record (Kanon, cvelistV5)

- CNA: **TR-CERT**
- State: PUBLISHED
- Stand: 2026-10-01 12:42:49
- CNA-CVSS: **9.1** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-348** — Use of Less Trusted Source
  The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

## Angriffsmuster (CAPEC)

- [CAPEC-73 — User-Controlled Filename](https://capec.mitre.org/data/definitions/73.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-85 — AJAX Footprinting](https://capec.mitre.org/data/definitions/85.html) _(Severity: Low)_
- [CAPEC-141 — Cache Poisoning](https://capec.mitre.org/data/definitions/141.html) _(Severity: High)_
- [CAPEC-142 — DNS Cache Poisoning](https://capec.mitre.org/data/definitions/142.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1557.002 — Adversary-in-the-Middle: ARP Cache Poisoning](https://attack.mitre.org/techniques/T1557/002/)
- [T1584.002 — Compromise Infrastructure: DNS Server](https://attack.mitre.org/techniques/T1584/002/)

## Referenzen

- <https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-16272/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_