CVE-2026-85531: Sipay Electronic Money And Payment Services Inc Opencart Virtual Pos Module

Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

Affected products

• Sipay Electronic Money And Payment Services Inc Opencart Virtual Pos Module: from 26.8.2, before 26.9.1 (fixed in 26.9.1)

Published 2026-10-09. Last modified 2026-10-09.