Skip to content
OpenAdvisories

Weakness (CWE)

CWE-841: Improper Enforcement of Behavioral Workflow

Class Incomplete

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence or timeframe.

Source: MITRE CWE-841

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-119558

    OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points

    OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points…

    OpenCart OpenCart
  • Low 3.5
    CVE-2026-77508

    Weblate: Unverified REST API email changes

    Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that addres…

    WeblateOrg weblate
  • Low 2.4
    CVE-2026-15365

    A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps o…

    vivo Kids Mode
  • Low 3.7
    CVE-2026-19208

    WonderTrader TraderDD.cpp queryTrades behavioral workflow

    A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched…

  • Low 2.7
    CVE-2026-8477

    Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server a…

    Devolutions Server
  • Low 2.7
    CVE-2025-13459

    IBM Aspera Console Denial of Service

    IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.

    IBM Aspera Console
  • Low 1.3
    CVE-2025-13751

    Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a lo…

    OpenVPN OpenVPN
  • Low 3.5
    CVE-2025-48376

    Dnn.Platform's Site Import could use an external source with a crafted request

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.1…

    dnnsoftware Dnn.Platform DotNetNuke.SiteExportImport NuGet
  • Low 3.3
    CVE-2023-42939

    A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private bro…

    Apple iOS and iPadOS iOS