991 matches found
CVE-2024-30896
CVE-2024-30896 Resumen Una falla de lógica de negocio en influxdb permite a los usuarios que poseen un token allAccess válido escalar sus privilegios al nivel de operador al listar los tokens de autorización actuales. Escenario El atacante podría ser un usuario al que un administrador le otorgó...
trappsec
trappsec trappsec es un framework de código abierto que ayuda a los desarrolladores a detectar atacantes que exploran la lógica de negocio de las APIs. Al incrustar rutas señuelo realistas y campos de miel difíciles de distinguir de las construcciones reales de la API, los atacantes son incitados...
CVE-2026-25126
CVE-2026-25126: Manipulación del Conteo de Votos en PolarLearn Investigación: Joshua van Rijswijk Descripción PoC para CVE-2026-25126 , una vulnerabilidad de lógica de negocio de alta severidad en la API de votación del foro de PolarLearn. El endpoint POST /api/v1/forum/vote no aplica una...
tirreno
tirreno tirreno es un software de análisis de seguridad abierto. tirreno tir.ˈrɛ.no ayuda a entender, monitorear y proteger tus aplicaciones de amenazas cibernéticas, robos de cuentas, bots y abusos. Mientras que la ciberseguridad clásica se centra en la infraestructura y el perímetro de red, la...
CVE-2024-50968
CVE-2024-50968 Descripción Existe una vulnerabilidad de lógica de negocio en la función Añadir al Carrito de itsourcecode Agri-Trading Online Shopping System 1.0, que permite a atacantes remotos manipular el parámetro quant al agregar un producto al carrito. Al establecer el valor de cantidad en...
CVE-2020-10130
CVE-2020-10130 - El producto SearchBlox anterior a V-9.1 es vulnerable a la omisión de lógica de negocio Descripción del producto: SearchBlox simplifica la búsqueda empresarial para organizaciones complejas. Las herramientas intuitivas e inteligentes de SearchBlox ofrecen configuración lista para...
Security Bulletin: IBM On Call Manager Mobile Application is affected by a vulnerability in regular expression processing
Summary A vulnerability in the xmldom library affects regular expression processiong for the IBM On Call Manager Android and iOS mobile applications. Vulnerability Details CVEID:CVE-2026-34601 DESCRIPTION: xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and...
CVE-2026-89050
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
EUVD-2026-77074
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
PT-2026-90949
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29810
CyberPanel versions prior to 2.4.4 contain a business-logic flaw where a required return 0 statement is omitted, leading to an incomplete authorization or validation check. The vulnerability is exploitable over the network with low complexity and requires low privileges (an authenticated account)...
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
GHSA-5VF4-452P-JJHF Shopper: Negative discount values accepted and propagated through order calculation pipeline
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
PT-2026-90547
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
CVE-2026-86753
snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...