Monthly
Local information disclosure in Huawei HarmonyOS and EMUI stems from a flawed permission-control check in the file system, letting a local actor read data that should be access-restricted. Exploitation requires local access plus user interaction (CVSS UI:R), and Huawei's own scoring rates it high impact; no public exploit was identified at time of analysis and it is not listed in CISA KEV. Note the vendor CVSS also asserts integrity and availability impact, which the one-line description (confidentiality only) does not substantiate.
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Business-logic manipulation in the MacroZheng mall e-commerce platform (mall-portal component) up to version 1.0.3 allows an authenticated storefront user to tamper with the coupon_amount and pay_amount parameters submitted to the /order/generateOrder endpoint, causing the OmsPortalOrderServiceImpl order-generation logic to compute incorrect order totals and payment records. The issue is a CWE-840 business-logic weakness rated 5.3 (CVSS 4.0) by the reporter; the assessed impact is limited to integrity (no confidentiality or availability effect), and exploitation requires a valid authenticated account plus the ability to submit an order - so it is a moderate-priority flaw rather than an urgent one. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor patch was published; notably, the vendor deleted the associated GitHub issue without explanation, which reduces the information available to defenders.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
Authenticated attackers can manipulate the goodsCount parameter in Newbee Mall's shopping cart quantity handler (endpoint /jshERP-boot/accountHead/updateAccountHeadAndDetail) to cause business logic errors, potentially leading to incorrect order totals or inventory records. The vulnerability affects all versions up to 2.7.5, and publicly available exploit code exists; however, active exploitation has not been confirmed (not in CISA KEV). With a CVSS score of 5.3 and impact limited to integrity (no confidentiality or availability loss), the overall risk is medium/low.
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified.
Cart quantity manipulation in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to exploit a business logic error in the OmsCartItemServiceImpl.updateQuantity function at the /cart/update/quantity endpoint by submitting maliciously crafted quantity values. The CWE-840 classification confirms the root cause is improper enforcement of business rules rather than a memory-safety flaw, allowing attackers to potentially submit negative, zero, or arbitrarily large quantity values to distort cart totals or order pricing. No public exploit code has been identified at time of analysis, and the vendor's unexplained deletion of the associated GitHub issue (#984) leaves patch status unresolved.
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.
Local information disclosure in Huawei HarmonyOS and EMUI stems from a flawed permission-control check in the file system, letting a local actor read data that should be access-restricted. Exploitation requires local access plus user interaction (CVSS UI:R), and Huawei's own scoring rates it high impact; no public exploit was identified at time of analysis and it is not listed in CISA KEV. Note the vendor CVSS also asserts integrity and availability impact, which the one-line description (confidentiality only) does not substantiate.
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Business-logic manipulation in the MacroZheng mall e-commerce platform (mall-portal component) up to version 1.0.3 allows an authenticated storefront user to tamper with the coupon_amount and pay_amount parameters submitted to the /order/generateOrder endpoint, causing the OmsPortalOrderServiceImpl order-generation logic to compute incorrect order totals and payment records. The issue is a CWE-840 business-logic weakness rated 5.3 (CVSS 4.0) by the reporter; the assessed impact is limited to integrity (no confidentiality or availability effect), and exploitation requires a valid authenticated account plus the ability to submit an order - so it is a moderate-priority flaw rather than an urgent one. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor patch was published; notably, the vendor deleted the associated GitHub issue without explanation, which reduces the information available to defenders.
Payment-amount tampering in macrozheng mall through version 1.0.3 lets a customer-side attacker override the amount submitted to Alipay: the portal's payment endpoint passes the client-supplied total_amount straight into the Alipay bizContent instead of the order's stored payAmount, so an attacker with a valid order can alter what is charged or recorded. Exploitation requires a live Alipay integration and an authenticated customer account holding a legitimate outTradeNo, and impact is confined to order/payment integrity rather than code execution or data exposure (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Public exploit code and the upstream fix commit are both available, but there is no indication the flaw is being actively exploited (not in CISA KEV).
Authenticated attackers can manipulate the goodsCount parameter in Newbee Mall's shopping cart quantity handler (endpoint /jshERP-boot/accountHead/updateAccountHeadAndDetail) to cause business logic errors, potentially leading to incorrect order totals or inventory records. The vulnerability affects all versions up to 2.7.5, and publicly available exploit code exists; however, active exploitation has not been confirmed (not in CISA KEV). With a CVSS score of 5.3 and impact limited to integrity (no confidentiality or availability loss), the overall risk is medium/low.
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.
Approval bypass in the Nextcloud Approval app allows an authenticated user holding approve/reject privileges - or an attacker positioned to intercept and modify that approver's outbound approve/reject HTTP request - to approve or reject a file version whose contents changed after the approver reviewed it, simply by omitting or blanking the etag parameter. The backend only applied its etag freshness check when the parameter was present and non-empty, so the review-integrity control is skippable; impact is limited to integrity of the approval decision (CVSS 4.3, PR:L, no confidentiality or availability effect). No public exploit code was identified at time of analysis, and this is assessed as a genuinely low-priority issue whose signals are consistent.
Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified.
Cart quantity manipulation in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to exploit a business logic error in the OmsCartItemServiceImpl.updateQuantity function at the /cart/update/quantity endpoint by submitting maliciously crafted quantity values. The CWE-840 classification confirms the root cause is improper enforcement of business rules rather than a memory-safety flaw, allowing attackers to potentially submit negative, zero, or arbitrarily large quantity values to distort cart totals or order pricing. No public exploit code has been identified at time of analysis, and the vendor's unexplained deletion of the associated GitHub issue (#984) leaves patch status unresolved.
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.