Verifone

11 CVEs across 15 Verifone products. Browse Verifone vulnerabilities, severities, and proof-of-concept exploits.

Verifone products with known CVEs

ProductCVEs
Mx9004
Mx900 Firmware4
Verix OS3
Vx5203
Commerce Paybox1
P2001
P200 Firmware1
P4001
P400 Firmware1
Vericentre Web Console1
Verix Multi-App Conductor1
Vx 8051
Vx 805 Firmware1
Vx 8201
Vx 820 Firmware1
Verifone CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-0750High7.52026-01-28Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This…
CVE-2019-14719High7.82020-10-23Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager.
CVE-2019-14718Medium6.72020-10-23Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privil…
CVE-2019-14717High7.82020-10-23Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.
CVE-2019-14716Medium6.62020-10-23Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).
CVE-2019-14715Medium6.82020-10-23Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.
CVE-2019-14713Medium5.52020-10-23Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.
CVE-2019-14712High7.82020-10-23Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation.
CVE-2019-14711High7.02020-10-23Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.
CVE-2019-10060High8.12019-03-26The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code v…
CVE-2012-49512012-11-15Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 36 allow remote attackers to execute arbi…