CWE-840 vulnerabilities

A business logic vulnerability in the Dokan WordPress plugin before version 5.3.3 allows vendors to reduce their commission debt by applying a discount coupon at checkout, resulting in paying less than the owed balance. This occurs because the plugin does not properly reconcile the credited amount in the vendor's reverse-withdrawal ledger with the actual payment collected. The issue is fixed in version 5.3.3.

A business logic flaw in Node.js 26.x's zlib.ZipFile API can cause it to return incorrect bytes from a ZIP archive when the local header does not match the central directory. This occurs because a validation error leaves a cached local header without a content offset, allowing attacker-controlled bytes to be returned while CRC-32 verification still passes. This discrepancy can cause Node.js-based ZIP scanners to approve different content than other ZIP implementations.

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.

A vulnerability exists in macrozheng mall versions 1.0.0 through 1.0.3 in the Payment Status Endpoint (/order/paySuccess). The issue involves manipulation of the orderId argument, which can enforce unintended behavioral workflow remotely. The vendor has not provided a patch or explanation, and the GitHub issue was deleted without comment. The CVSS score is 5.4, indicating a low severity level with limited impact on confidentiality but some impact on integrity and availability.

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used.

CVE-2026-41973 is a permission control vulnerability in Huawei HarmonyOS related to business logic errors (CWE-840). Successful exploitation may impact system availability. The vulnerability has a medium severity with a CVSS score of 5.9. It affects multiple versions of HarmonyOS including 4.0.0, 4.2.0, 4.3.0, and 4.3.1. No official patch or remediation guidance is currently available from the vendor.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a business logic vulnerability that allows bypassing access management controls. This issue is classified as CWE-840 and results in unauthorized modification capabilities without impacting confidentiality or availability. The vulnerability has a medium severity rating with a CVSS score of 4.9. No official patch or remediation guidance has been provided by the vendor at this time, and no known exploits are reported in the wild.

Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.

EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.