{"schema":"vulnpedia.research/1","cve":"CVE-2026-111637","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure","tags":["third-party-advisory","exploit"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","url":"https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-16T19:12:40.180Z","url":"https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure"},{"source":"nvd","sourceId":"CVE-2026-111637","modified":"2026-10-16T20:17:21.290","url":"https://hackmd.io/@hieuPenguinnn/nexopos-fields-endpoint-unauthenticated-transaction-disclosure"}]},{"url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18"},{"source":"nvd","sourceId":"CVE-2026-111637","modified":"2026-10-16T20:17:21.290","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/routes/api-base.php#L10-L18"}]},{"url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152"},{"source":"nvd","sourceId":"CVE-2026-111637","modified":"2026-10-16T20:17:21.290","url":"https://github.com/Blair2004/NexoPOS/blob/v6.2.4/app/Providers/FormsProvider.php#L126-L152"}]},{"url":"https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-16T17:39:08.931Z","url":"https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint"},{"source":"nvd","sourceId":"CVE-2026-111637","modified":"2026-10-16T20:17:21.290","url":"https://www.vulncheck.com/advisories/nexopos-through-6.2.4-unauthenticated-transaction-disclosure-via-api-fields-endpoint"}]},{"source":"euvd","sourceId":"EUVD-2026-103059","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103059","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-103059","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103059"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[]}