Monthly
Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified.
Cart quantity manipulation in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to exploit a business logic error in the OmsCartItemServiceImpl.updateQuantity function at the /cart/update/quantity endpoint by submitting maliciously crafted quantity values. The CWE-840 classification confirms the root cause is improper enforcement of business rules rather than a memory-safety flaw, allowing attackers to potentially submit negative, zero, or arbitrarily large quantity values to distort cart totals or order pricing. No public exploit code has been identified at time of analysis, and the vendor's unexplained deletion of the associated GitHub issue (#984) leaves patch status unresolved.
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.
Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.
Local information disclosure in Huawei HarmonyOS and EMUI stems from a flawed permission-control check in the file system, letting a local actor read data that should be access-restricted. Exploitation requires local access plus user interaction (CVSS UI:R), and Huawei's own scoring rates it high impact; no public exploit was identified at time of analysis and it is not listed in CISA KEV. Note the vendor CVSS also asserts integrity and availability impact, which the one-line description (confidentiality only) does not substantiate.
Price parameter manipulation in SourceCodester Simple Food Ordering System 1.0 allows unauthenticated remote attackers to submit orders at arbitrary prices by modifying the item_price argument in POST requests to /cart.php. The server trusts client-supplied price data without server-side validation, enabling business logic bypass (CWE-840) that could result in financial loss for system operators. A public proof-of-concept exploit is available on GitHub; however, this vulnerability is not currently listed in the CISA KEV catalog.
Permission control bypass in Huawei HarmonyOS and EMUI's call-handling subsystem allows a locally present, unprivileged attacker to circumvent intended access restrictions, resulting in low-level impacts to confidentiality, integrity, and availability. The vulnerability stems from improper business logic governing permission enforcement (CWE-840), meaning the system fails to correctly validate whether a calling entity holds the required permissions before servicing a request. No public exploit code exists and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog, but the low attack complexity and absence of privilege requirements lower the bar for local abuse.
Race condition in songquanpeng one-api's redemption code feature allows authenticated users to redeem a single-use code multiple times by sending concurrent requests before the transaction completes. The root cause is confirmed by PR diff: the codebase uses deprecated GORM v1 syntax (`tx.Set("gorm:query_option", "FOR UPDATE")`) that does not reliably apply a database row lock in GORM v2, leaving the transaction window unprotected. All versions up to 0.6.11-preview.7 are affected; a fix exists as an unmerged pull request, and publicly available exploit code is referenced in GitHub issue #2397 - no public exploit has been identified at time of analysis.
Business logic flaws in PublicCMS 5.202506.d trade payment controller allow unauthenticated remote attackers to manipulate payment processing workflows, potentially enabling payment bypass or unauthorized transaction modifications. Publicly available exploit code exists demonstrating the attack. The vulnerability affects three payment-related functions (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) in the publiccms-trade module. Vendor was notified but did not respond, and no patch has been announced.
A permission control vulnerability in HarmonyOS's manufacturability design module allows local attackers without privileges to read, modify, and degrade system availability through improper access controls. The vulnerability affects HarmonyOS across multiple versions and has a CVSS score of 5.9 (medium severity), with confirmed impacts on confidentiality, integrity, and availability despite the description emphasizing availability impact alone.
Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified.
Cart quantity manipulation in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to exploit a business logic error in the OmsCartItemServiceImpl.updateQuantity function at the /cart/update/quantity endpoint by submitting maliciously crafted quantity values. The CWE-840 classification confirms the root cause is improper enforcement of business rules rather than a memory-safety flaw, allowing attackers to potentially submit negative, zero, or arbitrarily large quantity values to distort cart totals or order pricing. No public exploit code has been identified at time of analysis, and the vendor's unexplained deletion of the associated GitHub issue (#984) leaves patch status unresolved.
Business logic bypass in Bagisto's RMA (Return Merchandise Authorization) module allows authenticated remote customers to manipulate workflow-critical parameters - rma_qty, resolution_type, and rma_reason_id - at the /customer/account/rma/store endpoint in versions up to 2.4.4. The integrity impact is limited to the RMA subsystem, but exploitation could enable unauthorized refund claims, fraudulent return approvals, or workflow state corruption. A public proof-of-concept is available; the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor has acknowledged the issue and states partial remediation is in progress through their internal security lifecycle.
Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.
Local information disclosure in Huawei HarmonyOS and EMUI stems from a flawed permission-control check in the file system, letting a local actor read data that should be access-restricted. Exploitation requires local access plus user interaction (CVSS UI:R), and Huawei's own scoring rates it high impact; no public exploit was identified at time of analysis and it is not listed in CISA KEV. Note the vendor CVSS also asserts integrity and availability impact, which the one-line description (confidentiality only) does not substantiate.
Price parameter manipulation in SourceCodester Simple Food Ordering System 1.0 allows unauthenticated remote attackers to submit orders at arbitrary prices by modifying the item_price argument in POST requests to /cart.php. The server trusts client-supplied price data without server-side validation, enabling business logic bypass (CWE-840) that could result in financial loss for system operators. A public proof-of-concept exploit is available on GitHub; however, this vulnerability is not currently listed in the CISA KEV catalog.
Permission control bypass in Huawei HarmonyOS and EMUI's call-handling subsystem allows a locally present, unprivileged attacker to circumvent intended access restrictions, resulting in low-level impacts to confidentiality, integrity, and availability. The vulnerability stems from improper business logic governing permission enforcement (CWE-840), meaning the system fails to correctly validate whether a calling entity holds the required permissions before servicing a request. No public exploit code exists and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog, but the low attack complexity and absence of privilege requirements lower the bar for local abuse.
Race condition in songquanpeng one-api's redemption code feature allows authenticated users to redeem a single-use code multiple times by sending concurrent requests before the transaction completes. The root cause is confirmed by PR diff: the codebase uses deprecated GORM v1 syntax (`tx.Set("gorm:query_option", "FOR UPDATE")`) that does not reliably apply a database row lock in GORM v2, leaving the transaction window unprotected. All versions up to 0.6.11-preview.7 are affected; a fix exists as an unmerged pull request, and publicly available exploit code is referenced in GitHub issue #2397 - no public exploit has been identified at time of analysis.
Business logic flaws in PublicCMS 5.202506.d trade payment controller allow unauthenticated remote attackers to manipulate payment processing workflows, potentially enabling payment bypass or unauthorized transaction modifications. Publicly available exploit code exists demonstrating the attack. The vulnerability affects three payment-related functions (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) in the publiccms-trade module. Vendor was notified but did not respond, and no patch has been announced.
A permission control vulnerability in HarmonyOS's manufacturability design module allows local attackers without privileges to read, modify, and degrade system availability through improper access controls. The vulnerability affects HarmonyOS across multiple versions and has a CVSS score of 5.9 (medium severity), with confirmed impacts on confidentiality, integrity, and availability despite the description emphasizing availability impact alone.