---
id: CVE-2026-16025
title: >-
  Improper validation of specified quantity in input vulnerability in PayTR
  Payment and Electronic Money Institution Inc
summary: >-
  Improper validation of specified quantity in input vulnerability in PayTR
  Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API
  WHMCS Module allows Input Data Manipulation.


  This issue affects PayTR Virtual Pos iFram…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1284
vendor: PayTR Payment and Electronic Money Institution Inc.
product: PayTR Virtual Pos iFrame API WHMCS Module
affected:
  - paytr_virtual_pos_iframe_api_whmcs_module >= v9.0.0 < v9.0.3
published: '2026-09-08'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T13:17:09.217'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16025'
references:
  - url: 'https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1034'
    label: iletisim@usom.gov.tr
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T15:46:57.286610Z'
epss: 0.0046
epssPercentile: 0.39694
ingestedAt: '2026-09-08T15:33:26.988Z'
---

## Overview

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation.

This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.