Overview 110 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
110matches
2in Waratek scope1.8%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
1.8%
Outside Waratek scope
1
0.9%
Not applicable
107
97.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
110
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
44
40.0%
Forecast only
0
0.0%
No public exploit
66
60.0%
split by
peak 41 / year
20192
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20203
Not applicable3
Medium3
not blocked3
No public exploit3
20216
Not applicable6
High1
Medium5
not blocked6
Proof of concept only3
No public exploit3
202215
No exploit published1
Outside Waratek scope1
Not applicable13
Critical4
High4
Medium7
not blocked15
Proof of concept only5
No public exploit10
202312
Not applicable12
High2
Medium8
Low2
not blocked12
Proof of concept only5
No public exploit7
202413
Not applicable13
Critical1
High4
Medium7
Low1
not blocked13
Proof of concept only4
No public exploit9
202518
Not applicable18
High7
Medium9
Low2
not blocked18
Proof of concept only6
No public exploit12
202641
No exploit published1
Not applicable40
High2
Medium21
Low18
not blocked41
Proof of concept only21
No public exploit20
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-124576 | Medium | 2026-11-09 | Not applicable | Proof of concept only | A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component. |
| CVE-2026-124566 | Medium | 2026-11-09 | Not applicable | No public exploit | A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-123788 | Medium | 2026-11-06 | Not applicable | Proof of concept only | A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended. |
| CVE-2026-116461 | Low | 2026-10-26 | Not applicable | Proof of concept only | A vulnerability was determined in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Executing a manipulation of the argument productUnitSalePrice can lead to business logic errors. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-106070 | Low | 2026-10-23 | Not applicable | No public exploit | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**. |
| CVE-2026-115248 | Low | 2026-10-22 | Not applicable | Proof of concept only | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-112028 | Medium | 2026-10-18 | Not applicable | Proof of concept only | A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-109406 | Medium | 2026-10-13 | Not applicable | No public exploit | A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. |
| CVE-2026-108789 | Low | 2026-10-12 | Not applicable | Proof of concept only | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-108784 | Medium | 2026-10-12 | Not applicable | Proof of concept only | A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue. |
| CVE-2026-105573 | Low | 2026-10-06 | Not applicable | Proof of concept only | A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-77166 | Low | 2026-09-21 | Not applicable | Proof of concept only | The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items. |
| CVE-2026-82982 | Medium | 2026-09-18 | Not applicable | No public exploit | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed. |
| CVE-2026-85030 | Low | 2026-09-03 | Not applicable | Proof of concept only | A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game. |
| CVE-2026-82423 | Low | 2026-08-29 | Not applicable | No public exploit | A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. |
| CVE-2026-79406 | Medium | 2026-08-25 | Not applicable | No public exploit | A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. |
| CVE-2026-75081 | Low | 2026-08-18 | Not applicable | Proof of concept only | A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rma_qty/resolution_type/rma_reason_id results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." |
| CVE-2026-19993 | Low | 2026-08-17 | Not applicable | Proof of concept only | A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." |
| CVE-2026-19213 | Low | 2026-08-07 | Not applicable | Proof of concept only | A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-19208 | Low | 2026-08-07 | Not applicable | Proof of concept only | A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-19037 | Low | 2026-08-06 | Not applicable | Proof of concept only | A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-58558 | High | 2026-07-15 | Not applicable | No public exploit | Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-13571 | Medium | 2026-06-29 | Not applicable | Proof of concept only | A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used. |
| CVE-2026-41973 | Medium | 2026-06-09 | Not applicable | No public exploit | Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-11465 | Low | 2026-06-07 | Not applicable | Proof of concept only | A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance. |
| CVE-2026-8738 | Medium | 2026-05-17 | Not applicable | No public exploit | A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-41971 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-41968 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41967 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41966 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-41965 | Medium | 2026-05-15 | Not applicable | No public exploit | Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41961 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-1322 | High | 2026-05-14 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization. |
| CVE-2026-1274 | Medium | 2026-04-23 | Not applicable | No public exploit | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel. |
| CVE-2026-5812 | Low | 2026-04-08 | Not applicable | Proof of concept only | A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-5811 | Low | 2026-04-08 | Not applicable | Proof of concept only | A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used. |
| CVE-2026-4547 | Medium | 2026-03-22 | Not applicable | No public exploit | A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely. |
| CVE-2026-28550 | Medium | 2026-03-05 | Not applicable | No public exploit | Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-1600 | Low | 2026-01-29 | Not applicable | Proof of concept only | A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-1599 | Low | 2026-01-29 | Not applicable | Proof of concept only | A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-14559 | Medium | 2026-01-21 | No exploit published | No public exploit | A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow. |
| CVE-2025-13239 | Low | 2025-11-16 | Not applicable | Proof of concept only | A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-6601 | Medium | 2025-10-27 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow. |
| CVE-2025-58289 | Medium | 2025-10-11 | Not applicable | No public exploit | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-10868 | Medium | 2025-09-26 | Not applicable | No public exploit | An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs. |
| CVE-2025-8991 | Low | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express of the component Business Logic Handler. The manipulation of the argument litemall_express_freight_min leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-54611 | High | 2025-08-06 | Not applicable | No public exploit | EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-54606 | High | 2025-08-06 | Not applicable | No public exploit | Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
| CVE-2025-2938 | High | 2025-06-26 | Not applicable | No public exploit | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants. |
| CVE-2025-4037 | Medium | 2025-04-28 | Not applicable | Proof of concept only | A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function moneyDeposit/moneyWithdraw. The manipulation leads to business logic errors. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. |
| CVE-2025-1908 | High | 2025-04-24 | Not applicable | No public exploit | An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1. |
| CVE-2024-6577 | Medium | 2025-03-20 | Not applicable | Proof of concept only | In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data. |
| CVE-2025-2323 | Medium | 2025-03-15 | Not applicable | Proof of concept only | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQuestionCou of the file /api/mjkj-chat/chat/mng/update/questionCou of the component Number of Question Handler. The manipulation leads to enforcement of behavioral workflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-2321 | Medium | 2025-03-15 | Not applicable | Proof of concept only | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-58046 | Medium | 2025-03-04 | Not applicable | No public exploit | Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-58043 | High | 2025-03-04 | Not applicable | No public exploit | Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-45424 | High | 2025-02-25 | Not applicable | No public exploit | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2025-24425 | Medium | 2025-02-11 | Not applicable | No public exploit | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction. |
| CVE-2024-56449 | High | 2025-01-08 | Not applicable | No public exploit | Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-54098 | High | 2024-12-12 | Not applicable | No public exploit | Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity. |
| CVE-2024-1682 | Medium | 2024-11-14 | Not applicable | Proof of concept only | An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks. |
| CVE-2024-51523 | High | 2024-11-05 | Not applicable | No public exploit | Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2018-25104 | Medium | 2024-10-17 | Not applicable | No public exploit | A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component. |
| CVE-2024-6446 | Low | 2024-09-12 | Not applicable | No public exploit | An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application. |
| CVE-2024-42034 | Medium | 2024-08-08 | Not applicable | No public exploit | LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-39671 | Critical | 2024-07-25 | Not applicable | No public exploit | Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2023-7271 | Medium | 2024-07-25 | Not applicable | No public exploit | Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-4046 | Medium | 2024-05-14 | Not applicable | No public exploit | Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-32999 | Medium | 2024-05-14 | Not applicable | No public exploit | Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-1456 | High | 2024-04-16 | Not applicable | Proof of concept only | An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover. |
| CVE-2024-2267 | High | 2024-03-07 | Not applicable | Proof of concept only | A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic errors. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256037 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-2151 | Medium | 2024-03-04 | Not applicable | Proof of concept only | A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument quantity with the input -1 leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255583. |
| CVE-2023-6832 | Medium | 2023-12-15 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
| CVE-2023-6566 | Medium | 2023-12-07 | Not applicable | No public exploit | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
| CVE-2023-6514 | High | 2023-12-06 | Not applicable | No public exploit | The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions. Successful exploitation of this vulnerability may allow attackers to access restricted functions. |
| CVE-2023-6017 | High | 2023-11-16 | Not applicable | No public exploit | H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. |
| CVE-2023-4304 | Low | 2023-08-11 | Not applicable | No public exploit | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0. |
| CVE-2023-29294 | Medium | 2023-06-15 | Not applicable | No public exploit | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction. |
| CVE-2023-3229 | Medium | 2023-06-14 | Not applicable | No public exploit | Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
| CVE-2023-3228 | Medium | 2023-06-14 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
| CVE-2023-1887 | Medium | 2023-04-05 | Not applicable | No public exploit | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
| CVE-2023-1542 | Medium | 2023-03-21 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. |
| CVE-2023-1541 | Low | 2023-03-21 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. |
| CVE-2023-0565 | Medium | 2023-01-29 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. |
| CVE-2022-4719 | Critical | 2022-12-27 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
| CVE-2022-3363 | Critical | 2022-10-26 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7. |
| CVE-2022-32208 | Medium | 2022-07-07 | Not applicable | Proof of concept only | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. |
| CVE-2022-32207 | Critical | 2022-07-07 | Outside Waratek scope | Proof of concept only | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. |
| CVE-2022-27782 | High | 2022-06-02 | Not applicable | Proof of concept only | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. |
| CVE-2022-1848 | Medium | 2022-05-24 | No exploit published | No public exploit | Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. |
| CVE-2022-0935 | High | 2022-04-07 | Not applicable | No public exploit | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. |
| CVE-2022-1155 | High | 2022-03-30 | Not applicable | No public exploit | Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. |
| CVE-2022-0514 | Medium | 2022-03-21 | Not applicable | No public exploit | Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5. |
| CVE-2022-0746 | Medium | 2022-02-25 | Not applicable | No public exploit | Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. |
| CVE-2022-0688 | Medium | 2022-02-20 | Not applicable | No public exploit | Business Logic Errors in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2022-0689 | Medium | 2022-02-19 | Not applicable | No public exploit | Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2022-0524 | High | 2022-02-08 | Not applicable | No public exploit | Business Logic Errors in GitHub repository publify/publify prior to 9.2.7. |
| CVE-2021-4146 | Medium | 2022-01-18 | Not applicable | No public exploit | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. |
| CVE-2021-4171 | Critical | 2022-01-17 | Not applicable | No public exploit | calibre-web is vulnerable to Business Logic Errors |
| CVE-2021-4117 | Medium | 2021-12-15 | Not applicable | No public exploit | yetiforcecrm is vulnerable to Business Logic Errors |