CVE-2024-50968

CVE-2024-50968 描述 itsourcecode Agri-Trading Online Shopping System 1.0 的“添加到购物车”功能存在业务逻辑漏洞，允许远程攻击者在向购物车添加产品时操纵 quant 参数。通过将数量值设置为 -0，攻击者可以利用应用程序总价计算逻辑中的缺陷。此漏洞导致总价降至零，使攻击者能够将商品添加到购物车并继续结账。 漏洞类型 业务逻辑漏洞 产品供应商 itsourcecode 受影响产品代码库： Agri-Trading Online Shopping System - 1.0 受影响组件： 其 sourcecode...

CVE-2024-30896

CVE-2024-30896 Zusammenfassung Ein Business-Logik-Fehler in influxdb ermöglicht es Benutzern, die ein gültiges allAccess-Token besitzen, ihre Privilegien auf Operator-Ebene auszuweiten, indem sie aktuelle Autorisierungs-Token auflisten. Szenario Ein Angreifer könnte ein Benutzer sein, dem ein...

CVE-2020-10130

CVE-2020-10130 - SearchBlox Produkt vor V-9.1 ist anfällig für Business-Logik-Umgehung Produktbeschreibung: SearchBlox vereinfacht die Unternehmenssuche für komplexe Organisationen. Die intuitiven und intelligenten Werkzeuge von SearchBlox bieten eine sofort einsatzbereite Einrichtung, sichere...

tirreno

tirreno tirreno è un sistema open di security analytics. tirreno tir.ˈrɛ.no aiuta a comprendere, monitorare e proteggere le tue applicazioni da minacce informatiche, compromissioni di account, bot e abusi. Mentre la cybersecurity classica si concentra su infrastrutture e perimetro di rete, la...

CVE-2026-80195

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-80195

Kimai before 2.63.0 has a business logic / improper authorization flaw in the team update API endpoint (PATCH /api/teams/{id} ). The endpoint deletes all existing team membership rows before validating the submitted replacement member list. An authenticated user with team-edit permission can ther...

CVE-2026-79406

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor...

CVE-2026-79406

macrozheng mall (open-source e-commerce platform) versions up to 1.0.3 contain a business logic error in the function OmsCartItemServiceImpl.updateQuantity , accessible via the endpoint /cart/update/quantity . Manipulating the quantity argument allows a remote, authenticated attacker to trigger l...

EUVD-2026-65486

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor...

PT-2026-81908

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

trappsec

trappsec trappsec ist ein Open-Source-Framework, das Entwicklern hilft, Angreifer zu erkennen, die die Geschäftslogik von APIs untersuchen. Durch die Einbettung realistischer Decoy Routes und Honey Fields, die kaum von echten API-Konstrukten zu unterscheiden sind, werden Angreifer dazu verleitet,...

CVE-2026-61268

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Business Logic Infra SEC. Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

EUVD-2026-61346

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Business Logic Infra SEC. Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards...

PT-2026-77502

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.4 Description An issue exists in the Business Logic Infra SEC component that allows a low privileged attacker with network access via HTTP to compromise the system. Successf...

CVE-2026-63242 Business logic vulnerability

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...

CVE-2026-13724

Technical details about CVE-2026-13724 are not publicly available in the provided documents. The description mentions a client-side bypass and input manipulation in Gobito's Corporate Training Management System, but no concrete affected versions or remediation are disclosed. Monitor for updates.

CVE-2024-23564

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verif...

CVE-2024-23564

The CVE-2024-23564 entry concerns HCL Aftermarket EPC and describes a Business Logic Vulnerability where a non-valid user can obtain passwords from the server and have them redirected to their own email by manipulating the server response. The root cause, as stated, is that the system validates U...

CVE-2024-23564

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verif...