CWE-840 · Input Validation and Logic
Business Logic Errors
98CVEs
SortMost likely exploited
98 CVEs with CWE-840 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-22926libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool)…Haxx · https://github.com/curl/curl · CVSS 7.5 · 2021-08-05 | 7.5 | 15% | 2021-08-05 |
| CVE-2022-32207When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final…Haxx · https://github.com/curl/curl · CVSS 9.8 · 2022-07-07 | 9.8 | 12% | 2022-07-07 |
| CVE-2022-32208When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed…Haxx · https://github.com/curl/curl · CVSS 5.9 · 2022-07-07 | 5.9 | 8.4% | 2022-07-07 |
| CVE-2021-22922When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out t…Haxx · https://github.com/curl/curl · CVSS 6.5 · 2021-08-05 | 6.5 | 4.3% | 2021-08-05 |
| CVE-2021-22897curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schanne…Haxx · https://github.com/curl/curl · CVSS 5.3 · 2021-06-11 | 5.3 | 4.3% | 2021-06-11 |
| CVE-2022-27782libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connectio…Haxx · https://github.com/curl/curl · CVSS 7.5 · 2022-06-01 | 7.5 | 3.1% | 2022-06-01 |
| CVE-2021-36012Magento Commerce Gift Card Business Logic ErrorAdobe · Magento Commerce · CVSS 6.5 · 2021-09-01 | 6.5 | 1.9% | 2021-09-01 |
| CVE-2020-8228A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.Nextcloud · Nextcloud Preferred Provider · 2020-10-05 | – | 1.9% | 2020-10-05 |
| CVE-2019-15608The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when readin…Yarnpkg · yarn · 2020-03-15 | – | 1.8% | 2020-03-15 |
| CVE-2022-0524Business Logic Errors in publify/publifypublify · publify/publify · CVSS 6.5 · 2022-02-08 | 6.5 | 1.6% | 2022-02-08 |
| CVE-2021-4171Business Logic Errors in janeczku/calibre-webjaneczku · janeczku/calibre-web · CVSS 7.7 · 2022-01-17 | 7.7 | 1.4% | 2022-01-17 |
| CVE-2022-0935Host Header injection in password Reset in livehelperchat/livehelperchatlivehelperchat · livehelperchat/livehelperchat · CVSS 8.8 · 2022-04-07 | 8.8 | 1.3% | 2022-04-07 |
| CVE-2019-3787UAA defaults email address to an insecure domainCloud Foundry · UAA Release (OSS) · CVSS 8.3 · 2019-06-19 | 8.3 | 1.1% | 2019-06-19 |
| CVE-2022-0689Use multiple time the one-time coupon in microweber/microwebermicroweber · microweber/microweber · CVSS 5.3 · 2022-02-19 | 5.3 | 1.0% | 2022-02-19 |
| CVE-2022-4719Business Logic Errors in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 5.7 · 2022-12-23 | 5.7 | 1.0% | 2022-12-23 |
| CVE-2022-1848Business Logic Errors in erudika/paraerudika · erudika/para · CVSS 9 · 2022-05-24 | 9.0 | 1.0% | 2022-05-24 |
| CVE-2022-3363Business Logic Errors in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 2.8 · 2022-10-26 | 2.8 | 1.0% | 2022-10-26 |
| CVE-2022-1155Old sessions are not blocked by the login enable function. in snipe/snipe-itsnipe · snipe/snipe-it · CVSS 7.4 · 2022-03-30 | 7.4 | 1.0% | 2022-03-30 |
| CVE-2022-0514Business Logic Errors in crater-invoice/cratercrater-invoice · crater-invoice/crater · CVSS 6.5 · 2022-03-21 | 6.5 | 1.0% | 2022-03-21 |
| CVE-2022-0688Business Logic Errors in microweber/microwebermicroweber · microweber/microweber · CVSS 9.4 · 2022-02-20 | 9.4 | 0.9% | 2022-02-20 |
| CVE-2022-0746Business Logic Errors in dolibarr/dolibarrdolibarr · dolibarr/dolibarr · CVSS 4.3 · 2022-02-25 | 4.3 | 0.9% | 2022-02-25 |
| CVE-2023-6017H2O S3 Bucket Takeoverh2oai · h2oai/h2o-3 · CVSS 8.7 · 2023-11-16 | 8.7 | 0.9% | 2023-11-16 |
| CVE-2021-4146Business Logic Errors in pimcore/pimcorepimcore · pimcore/pimcore · CVSS 4.3 · 2022-01-18 | 4.3 | 0.8% | 2022-01-18 |
| CVE-2020-8181A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.Nextcloud · Nextcloud Contact · 2020-07-10 | – | 0.8% | 2020-07-10 |
| CVE-2019-3789Gorouter allows space developer to hijack route services hosted outside the platformCloud Foundry · CF Routing · CVSS 8.8 · 2019-04-24 | 8.8 | 0.8% | 2019-04-24 |
| CVE-2023-1542Business Logic Errors in answerdev/answeranswerdev · answerdev/answer · CVSS 8.1 · 2023-03-21 | 8.1 | 0.8% | 2023-03-21 |
| CVE-2023-29294Bypass Purchase Order Approval using Company User in Adobe Commerce B2BAdobe · Magento Commerce · CVSS 4.3 · 2023-06-15 | 4.3 | 0.7% | 2023-06-15 |
| CVE-2021-4117Business Logic Errors in yetiforcecompany/yetiforcecrmyetiforcecompany · yetiforcecompany/yetiforcecrm · CVSS 7.7 · 2021-12-15 | 7.7 | 0.7% | 2021-12-15 |
| CVE-2023-1887Business Logic Errors in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 8.3 · 2023-04-05 | 8.3 | 0.7% | 2023-04-05 |
| CVE-2023-1541Business Logic Errors in answerdev/answeranswerdev · answerdev/answer · CVSS 6 · 2023-03-21 | 6.0 | 0.6% | 2023-03-21 |
| CVE-2021-4111Business Logic Errors in yetiforcecompany/yetiforcecrmyetiforcecompany · yetiforcecompany/yetiforcecrm · CVSS 7.3 · 2021-12-15 | 7.3 | 0.6% | 2021-12-15 |
| CVE-2025-24425Adobe Commerce | Business Logic Errors (CWE-840)Adobe · Adobe Commerce · CVSS 5.3 · 2025-02-11 | 5.3 | 0.6% | 2025-02-11 |
| CVE-2023-4304Business Logic Errors in froxlor/froxlorfroxlor · froxlor/froxlor · CVSS 3.8 · 2023-08-11 | 3.8 | 0.6% | 2023-08-11 |
| CVE-2023-0565Business Logic Errors in froxlor/froxlorfroxlor · froxlor/froxlor · CVSS 5.5 · 2023-01-29 | 5.5 | 0.6% | 2023-01-29 |
| CVE-2024-2151SourceCodester Online Mobile Management Store Product Price logic errorSourceCodester · Online Mobile Management Store · CVSS 4.3 · 2024-03-03 | 4.3 | 0.5% | 2024-03-03 |
| CVE-2024-2267keerti1924 Online-Book-Store-Website shop.php logic errorkeerti1924 · Online-Book-Store-Website · CVSS 4.3 · 2024-03-07 | 4.3 | 0.5% | 2024-03-07 |
| CVE-2023-6832Business Logic Errors in microweber/microwebermicroweber · microweber/microweber · CVSS 6 · 2023-12-15 | 6.0 | 0.5% | 2023-12-15 |
| CVE-2026-13571SourceCodester Simple Food Ordering System cart.php logic errorSourceCodester · Simple Food Ordering System · CVSS 5.3 · 2026-06-29 | 5.3 | 0.5% | 2026-06-29 |
| CVE-2023-3229Business Logic Errors in fossbilling/fossbillingfossbilling · fossbilling/fossbilling · CVSS 5.4 · 2023-06-14 | 5.4 | 0.5% | 2023-06-14 |
| CVE-2023-6566Business Logic Errors in microweber/microwebermicroweber · microweber/microweber · CVSS 5.9 · 2023-12-07 | 5.9 | 0.5% | 2023-12-07 |
| CVE-2025-14559Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled usersRed Hat · Red Hat build of Keycloak 26.4 · CVSS 6.5 · 2026-01-21 | 6.5 | 0.5% | 2026-01-21 |
| CVE-2023-3228Business Logic Errors in fossbilling/fossbillingfossbilling · fossbilling/fossbilling · CVSS 5.4 · 2023-06-14 | 5.4 | 0.5% | 2023-06-14 |
| CVE-2026-85030HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic errorHKUDS · AI-Trader · CVSS 3.7 · 2026-09-03 | 3.7 | 0.5% | 2026-09-03 |
| CVE-2025-2321274056675 springboot-openai-chatgpt addData logic error274056675 · springboot-openai-chatgpt · CVSS 6.3 · 2025-03-15 | 6.3 | 0.4% | 2025-03-15 |
| CVE-2024-1682Unclaimed S3 Bucket Reference in psf/requests Documentationpsf · psf/requests · CVSS 4.3 · 2024-11-14 | 4.3 | 0.4% | 2024-11-14 |
| CVE-2024-6446Business Logic Errors in GitLabGitLab · GitLab · CVSS 3.5 · 2024-09-12 | 3.5 | 0.4% | 2024-09-12 |
| CVE-2024-6577Unclaimed S3 Bucket Usage in pytorch/servepytorch · pytorch/serve · CVSS 6.3 · 2025-03-20 | 6.3 | 0.4% | 2025-03-20 |
| CVE-2025-1908Business Logic Errors in GitLabGitLab · GitLab · CVSS 7.7 · 2025-04-24 | 7.7 | 0.4% | 2025-04-24 |
| CVE-2026-79406macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic errormacrozheng · mall · CVSS 4.3 · 2026-08-25 | 4.3 | 0.4% | 2026-08-25 |
| CVE-2024-45424Zoom Workplace Apps - Business Logic ErrorZoom Communications, Inc · Zoom Workplace Apps · CVSS 5.3 · 2025-02-25 | 5.3 | 0.4% | 2025-02-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.