CWE-837 · Input Validation and Logic
Improper Enforcement of a Single, Unique Action
18CVEs
SortMost likely exploited
18 CVEs with CWE-837 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-11716While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's…CTFd · CTFd · CVSS 5.3 · 2025-01-02 | 5.3 | 12% | 2025-01-02 |
| CVE-2023-6759Thecosy IceCMS Love resource improper enforcement of a single, unique actionThecosy · IceCMS · CVSS 5.3 · 2023-12-13 | 5.3 | 1.0% | 2023-12-13 |
| CVE-2024-4629Keycloak: potential bypass of brute force protectionRed Hat · Red Hat Build of Keycloak · CVSS 6.5 · 2024-09-03 | 6.5 | 0.8% | 2024-09-03 |
| CVE-2023-6438Thecosy IceCMS Like improper enforcement of a single, unique actionThecosy · IceCMS · CVSS 4.3 · 2023-11-30 | 4.3 | 0.7% | 2023-11-30 |
| CVE-2024-11717Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and t…CTFd · CTFd · CVSS 6.3 · 2025-01-02 | 6.3 | 0.7% | 2025-01-02 |
| CVE-2023-6467Thecosy IceCMS Comment Like improper enforcement of a single, unique actionThecosy · IceCMS · CVSS 3.1 · 2023-12-02 | 3.1 | 0.6% | 2023-12-02 |
| CVE-2024-11301Improper Enforcement of Unique Constraint in lunary-ai/lunarylunary-ai · lunary-ai/lunary · CVSS 6.5 · 2025-03-20 | 6.5 | 0.6% | 2025-03-20 |
| CVE-2023-5313phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique actionphpkobo · Ajax Poll Script · CVSS 5.3 · 2023-09-30 | 5.3 | 0.6% | 2023-09-30 |
| CVE-2026-45734MyBB: Default CAPTCHA missing invalidationmybb · mybb · CVSS 5.3 · 2026-08-18 | 5.3 | 0.6% | 2026-08-18 |
| CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacketpmmp · PocketMine-MP · CVSS 4.2 · 2026-09-09 | 4.2 | 0.4% | 2026-09-09 |
| CVE-2025-54315The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.Matrix · Matrix specification · CVSS 7.1 · 2025-10-02 | 7.1 | 0.4% | 2025-10-02 |
| CVE-2026-44601Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.torproject · Tor · CVSS 3.7 · 2026-05-07 | 3.7 | 0.3% | 2026-05-07 |
| CVE-2026-105850Payload: Order confirmation validation issue in Payload Ecommercepayloadcms · payload · CVSS 8.8 · 2026-10-06 | 8.8 | 0.3% | 2026-10-06 |
| CVE-2026-112285Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later OrdersThelia · Thelia · CVSS 4.3 · 2026-10-19 | 4.3 | 0.3% | 2026-10-19 |
| CVE-2025-58135Zoom Workplace Clients for Windows - Improper Action EnforcementZoom Communications, Inc · Zoom Workplace Clients for Windows · CVSS 5.3 · 2025-09-09 | 5.3 | 0.3% | 2025-09-09 |
| CVE-2025-62782InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElementPhoenix616 · InventoryGui · CVSS 5.9 · 2025-10-27 | 5.9 | 0.3% | 2025-10-27 |
| CVE-2025-62783InventoryGui affected by item duplication in GUIs which use GuiStorageElementPhoenix616 · InventoryGui · CVSS 5 · 2025-10-27 | 5.0 | 0.3% | 2025-10-27 |
| CVE-2025-62784InventoryGui allows item duplication in GUIs which use GuiStorageElementPhoenix616 · InventoryGui · CVSS 5.3 · 2025-10-27 | 5.3 | 0.2% | 2025-10-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.