Weakness (CWE)
CWE-840: Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Source: MITRE CWE-840
22 results · Clear filters · Feed
-
High 7.3CVE-2026-124576 Public exploit
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…
-
High 7.8
Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect s…
-
High 7.3
EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability…
-
High 7.3
Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will…
-
High 7.7
Business Logic Errors in GitLab
An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
-
High 7.3
Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect s…
-
High 8.5
Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability ma…
-
High 7.1
Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may af…
-
High 7.1
S3 Bucket Takeover in h2oai/h2o-3
An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.
-
High 8.8
The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successf…
-
High 8.7
H2O S3 Bucket Takeover
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
-
High 8.3
Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.1
Business Logic Errors in answerdev/answer
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
High 8.8
Host Header injection in password Reset in livehelperchat/livehelperchat
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
-
High 7.4
Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
-
High 7.7
Business Logic Errors in janeczku/calibre-web
calibre-web is vulnerable to Business Logic Errors
-
High 7.7
Business Logic Errors in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Business Logic Errors
-
High 7.3
Business Logic Errors in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Business Logic Errors
-
High 7.5CVE-2021-22926 EPSS 15%
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `C…
-
High 8.3
UAA defaults email address to an insecure domain
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors in…
-
High 8.8
Gorouter allows space developer to hijack route services hosted outside the platform
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external dom…