Skip to content
BackEsc
Sign in

CWE-840 · weakness in Input Validation and Logic

Business Logic Errors

98 CVEs

Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

likely to be exploited
2

Every one of the 98 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool)…CVE-2021-22926https://github.com/curl/curl · CVSS 7.5 · 15% likely
  2. When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…CVE-2022-32207Haxx · CVSS 9.8 · 12% likely
  3. When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed…CVE-2022-32208Haxx · CVSS 5.9 · 8.4% likely
  4. When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out t…CVE-2021-22922https://github.com/curl/curl · CVSS 6.5 · 4.3% likely
  5. curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schanne…CVE-2021-22897https://github.com/curl/curl · CVSS 5.3 · 4.3% likely
  6. libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connectio…CVE-2022-27782Haxx · CVSS 7.5 · 3.1% likely
  7. Magento Commerce Gift Card Business Logic ErrorCVE-2021-36012Adobe · CVSS 6.5 · 1.9% likely

    Adobe

  8. A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.CVE-2020-8228Nextcloud Preferred Provider · 1.9% likely
  9. The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when readin…CVE-2019-15608yarn · 1.8% likely
  10. Business Logic Errors in publify/publifyCVE-2022-0524publify · CVSS 6.5 · 1.6% likely

    Publify

  11. Business Logic Errors in janeczku/calibre-webCVE-2021-4171janeczku · CVSS 7.7 · 1.4% likely

    Janeczku

  12. Host Header injection in password Reset in livehelperchat/livehelperchatCVE-2022-0935livehelperchat · CVSS 8.8 · 1.3% likely

    LiveHelperChat

  13. UAA defaults email address to an insecure domainCVE-2019-3787Cloud Foundry · CVSS 8.3 · 1.1% likely

    Cloud Foundry

  14. Use multiple time the one-time coupon in microweber/microweberCVE-2022-0689microweber · CVSS 5.3 · 1.0% likely

    Microweber

  15. Business Logic Errors in ikus060/rdiffwebCVE-2022-4719ikus060 · CVSS 5.7 · 1.0% likely

    Ikus060

  16. Business Logic Errors in erudika/paraCVE-2022-1848erudika · CVSS 9 · 1.0% likely

    Erudika

  17. Business Logic Errors in ikus060/rdiffwebCVE-2022-3363ikus060 · CVSS 2.8 · 1.0% likely

    Ikus060

  18. Old sessions are not blocked by the login enable function. in snipe/snipe-itCVE-2022-1155snipe · CVSS 7.4 · 1.0% likely

    Snipe

  19. Business Logic Errors in crater-invoice/craterCVE-2022-0514crater-invoice · CVSS 6.5 · 1.0% likely

    Crater-Invoice

  20. Business Logic Errors in microweber/microweberCVE-2022-0688microweber · CVSS 9.4 · 0.9% likely

    Microweber

  21. Business Logic Errors in dolibarr/dolibarrCVE-2022-0746dolibarr · CVSS 4.3 · 0.9% likely

    Dolibarr

  22. H2O S3 Bucket TakeoverCVE-2023-6017h2oai · CVSS 8.7 · 0.9% likely

    H2oai

  23. Business Logic Errors in pimcore/pimcoreCVE-2021-4146pimcore · CVSS 4.3 · 0.8% likely

    Pimcore

  24. A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.CVE-2020-8181Nextcloud Contact · 0.8% likely
  25. Gorouter allows space developer to hijack route services hosted outside the platformCVE-2019-3789Cloud Foundry · CVSS 8.8 · 0.8% likely

    Cloud Foundry

  26. Business Logic Errors in answerdev/answerCVE-2023-1542answerdev · CVSS 8.1 · 0.8% likely

    Answerdev

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in