CWE-840 — known CVE vulnerabilities

CVEs classified under CWE-840, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2022-4719 — CVSS 9.8 (critical): Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
• CVE-2022-3363 — CVSS 9.8 (critical): Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
• CVE-2021-4171 — CVSS 9.8 (critical): calibre-web is vulnerable to Business Logic Errors
• CVE-2024-39671 — CVSS 9.3 (critical): Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2024-54098 — CVSS 8.5 (high): Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2025-1908 — CVSS 7.7 (high): An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full…
• CVE-2022-0524 — CVSS 7.5 (high): Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
• CVE-2022-1155 — CVSS 7.4 (high): Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
• CVE-2025-54611 — CVSS 7.3 (high): EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2025-54606 — CVSS 7.3 (high): Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability…
• CVE-2024-58043 — CVSS 7.3 (high): Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2024-51523 — CVSS 7.1 (high): Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2024-1456 — CVSS 7.1 (high): An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/…
• CVE-2023-6017 — CVSS 7.1 (high): H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
• CVE-2026-1322 — CVSS 6.8 (medium): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before…
• CVE-2024-32999 — CVSS 6.8 (medium): Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
• CVE-2024-56449 — CVSS 6.6 (medium): Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2024-42034 — CVSS 6.6 (medium): LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2026-8738 — CVSS 6.5 (medium): A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentCo…
• CVE-2025-14559 — CVSS 6.5 (medium): A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for…
• CVE-2023-6566 — CVSS 6.5 (medium): Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
• CVE-2023-3229 — CVSS 6.5 (medium): Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
• CVE-2022-0514 — CVSS 6.5 (medium): Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
• CVE-2021-36012 — CVSS 6.5 (medium): Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the…
• CVE-2024-4046 — CVSS 6.4 (medium): Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.
• CVE-2024-6577 — CVSS 6.3 (medium): In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without…
• CVE-2025-2321 — CVSS 6.3 (medium): A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown…
• CVE-2026-41973 — CVSS 5.9 (medium): Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.
• CVE-2026-41968 — CVSS 5.9 (medium): Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect…
• CVE-2026-41967 — CVSS 5.9 (medium): Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect…
• CVE-2026-41961 — CVSS 5.9 (medium): Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.
• CVE-2023-3228 — CVSS 5.7 (medium): Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
• CVE-2026-41966 — CVSS 5.6 (medium): Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2026-41965 — CVSS 5.6 (medium): Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.
• CVE-2026-41971 — CVSS 5.5 (medium): Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2023-7271 — CVSS 5.5 (medium): Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.
• CVE-2023-0565 — CVSS 5.5 (medium): Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
• CVE-2026-5812 — CVSS 5.4 (medium): A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file…
• CVE-2026-5811 — CVSS 5.4 (medium): A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of…
• CVE-2023-1542 — CVSS 5.4 (medium): Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
• CVE-2026-13571 — CVSS 5.3 (medium): A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php…
• CVE-2024-45424 — CVSS 5.3 (medium): Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network…
• CVE-2025-24425 — CVSS 5.3 (medium): Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error…
• CVE-2022-1848 — CVSS 5.3 (medium): Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
• CVE-2022-0689 — CVSS 5.3 (medium): Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
• CVE-2026-1274 — CVSS 4.9 (medium): IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control…
• CVE-2022-0688 — CVSS 4.9 (medium): Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
• CVE-2025-4037 — CVSS 4.4 (medium): A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function…
• CVE-2026-4547 — CVSS 4.3 (medium): A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the…
• CVE-2026-1600 — CVSS 4.3 (medium): A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown…