Skip to content
OpenAdvisories

Weakness (CWE)

CWE-837: Improper Enforcement of a Single, Unique Action

Base Incomplete

The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or incorrectly enforces this restriction.

Source: MITRE CWE-837

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-105850

    Payload: Order confirmation validation issue in Payload Ecommerce

    Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed mo…

    payloadcms payload plugin-ecommerce @payloadcms/plugin-ecommerce npm
  • High 8.1
    CVE-2026-42609

    Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creatin…

    getgrav grav getgrav/grav Packagist
  • High 7.1
    CVE-2025-54315

    The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.

    Matrix Matrix specification