Common Weakness Enumeration
CWE-841
AllowedImproper Enforcement of Behavioral Workflow
Abstraction: Class · Status: Incomplete
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
79 vulnerabilities reference this CWE, most recent first.
CVE-2026-124576 (GCVE-0-2026-124576)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:00 – Updated: 2026-11-09 07:00 X_Open Source
VLAI
EPSS
VEX
Title
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
Summary
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
Severity
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432922 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432922/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124576 | third-party-advisory |
| https://vuldb.com/submit/1038160 | third-party-advisory |
| https://github.com/beikeshop/beikeshop/security/a… | broken-link |
| https://github.com/beikeshop/beikeshop/commit/6cf… | patch |
| https://github.com/beikeshop/beikeshop/releases/t… | patch |
| https://github.com/beikeshop/beikeshop/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | BeikeShop |
Affected:
2.0.0.0
Affected: 2.0.0.1 Affected: 2.0.0.2 Affected: 2.0.0.3 Affected: 2.0.0.4 Affected: 2.0.0.5 Affected: 2.0.0.6 Affected: 2.0.0.7 Affected: 2.0.0.8 Affected: 2.0.0.9 Affected: 2.0.0.10 Affected: 2.0.0.11 Affected: 2.0.0.12 Affected: 2.0.0.13 Affected: 2.0.0.14 Affected: 2.0.0.15 Affected: 2.0.0.16 Affected: 2.0.0.17 Affected: 2.0.0.18 Affected: 2.0.0.19 Affected: 2.0.0.20 Affected: 2.0.0.21 Affected: 2.0.0.22 Affected: 2.0.0.23 Affected: 2.0.0.24 Affected: 2.0.0.25 Affected: 2.0.0.26 Affected: 2.0.0.27 Affected: 2.0.0.28 Affected: 2.0.0.29 Affected: 2.0.0.30 Affected: 2.0.0.31 Unaffected: 2.0.0.32 cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:*"
],
"modules": [
"Guest Order Lookup"
],
"product": "BeikeShop",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.0.0.0"
},
{
"status": "affected",
"version": "2.0.0.1"
},
{
"status": "affected",
"version": "2.0.0.2"
},
{
"status": "affected",
"version": "2.0.0.3"
},
{
"status": "affected",
"version": "2.0.0.4"
},
{
"status": "affected",
"version": "2.0.0.5"
},
{
"status": "affected",
"version": "2.0.0.6"
},
{
"status": "affected",
"version": "2.0.0.7"
},
{
"status": "affected",
"version": "2.0.0.8"
},
{
"status": "affected",
"version": "2.0.0.9"
},
{
"status": "affected",
"version": "2.0.0.10"
},
{
"status": "affected",
"version": "2.0.0.11"
},
{
"status": "affected",
"version": "2.0.0.12"
},
{
"status": "affected",
"version": "2.0.0.13"
},
{
"status": "affected",
"version": "2.0.0.14"
},
{
"status": "affected",
"version": "2.0.0.15"
},
{
"status": "affected",
"version": "2.0.0.16"
},
{
"status": "affected",
"version": "2.0.0.17"
},
{
"status": "affected",
"version": "2.0.0.18"
},
{
"status": "affected",
"version": "2.0.0.19"
},
{
"status": "affected",
"version": "2.0.0.20"
},
{
"status": "affected",
"version": "2.0.0.21"
},
{
"status": "affected",
"version": "2.0.0.22"
},
{
"status": "affected",
"version": "2.0.0.23"
},
{
"status": "affected",
"version": "2.0.0.24"
},
{
"status": "affected",
"version": "2.0.0.25"
},
{
"status": "affected",
"version": "2.0.0.26"
},
{
"status": "affected",
"version": "2.0.0.27"
},
{
"status": "affected",
"version": "2.0.0.28"
},
{
"status": "affected",
"version": "2.0.0.29"
},
{
"status": "affected",
"version": "2.0.0.30"
},
{
"status": "affected",
"version": "2.0.0.31"
},
{
"status": "unaffected",
"version": "2.0.0.32"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fernando viana (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:00:23.096Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432922 | BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432922"
},
{
"name": "VDB-432922 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432922/cti"
},
{
"name": "CVE-2026-124576 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124576"
},
{
"name": "Submit #1038160 | beikeshop BeikeShop \u003c= 2.0.0.31 Improper Enforcement of Behavioral Workflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038160"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352"
},
{
"tags": [
"patch"
],
"url": "https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32"
},
{
"tags": [
"product"
],
"url": "https://github.com/beikeshop/beikeshop/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:04:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124576",
"datePublished": "2026-11-09T07:00:23.096Z",
"dateReserved": "2026-11-08T16:59:31.143Z",
"dateUpdated": "2026-11-09T07:00:23.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124566 (GCVE-0-2026-124566)
Vulnerability from cvelistv5 – Published: 2026-11-09 04:30 – Updated: 2026-11-09 14:06
VLAI
EPSS
VEX
Title
fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow
Summary
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:06 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432898 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432898/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124566 | third-party-advisory |
| https://vuldb.com/submit/1035644 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fushengqian | fuint |
Affected:
36cc31b08d77facc94e8959afa02224891b4fe5f
cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:06:20.988567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:06:32.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:*"
],
"modules": [
"Alipay Callback Handler"
],
"product": "fuint",
"vendor": "fushengqian",
"versions": [
{
"status": "affected",
"version": "36cc31b08d77facc94e8959afa02224891b4fe5f"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Y1Daa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T04:30:20.609Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432898 | fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432898"
},
{
"name": "VDB-432898 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432898/cti"
},
{
"name": "CVE-2026-124566 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124566"
},
{
"name": "Submit #1035644 | fushengqian fuint up to cb498ad2 Improper Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035644"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T16:00:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124566",
"datePublished": "2026-11-09T04:30:20.609Z",
"dateReserved": "2026-11-08T14:55:10.113Z",
"dateUpdated": "2026-11-09T14:06:32.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123788 (GCVE-0-2026-123788)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:15 – Updated: 2026-11-06 21:15 X_Open Source
VLAI
EPSS
VEX
Title
chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow
Summary
A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.
Severity
Assigner
VulDB
CNA
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431934 | vdb-entry |
| https://vuldb.com/vuln/431934/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123788 | third-party-advisory |
| https://vuldb.com/submit/1033606 | third-party-advisory |
| https://github.com/chenyme/grok2api/issues/1072 | issue-tracking |
| https://github.com/chenyme/grok2api/pull/1073 | issue-trackingpatch |
| https://github.com/chenyme/grok2api/commit/7ad0f7… | patch |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | patch |
| https://github.com/chenyme/grok2api/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
],
"modules": [
"STT Billing"
],
"product": "grok2api",
"vendor": "chenyme",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "affected",
"version": "3.1.3"
},
{
"status": "affected",
"version": "3.1.4"
},
{
"status": "affected",
"version": "3.1.5"
},
{
"status": "affected",
"version": "3.1.6"
},
{
"status": "unaffected",
"version": "3.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "carfeii (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:15:17.807Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431934 | chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/431934"
},
{
"name": "VDB-431934 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431934/cti"
},
{
"name": "CVE-2026-123788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123788"
},
{
"name": "Submit #1033606 | https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033606"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chenyme/grok2api/issues/1072"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/chenyme/grok2api/pull/1073"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/chenyme/grok2api/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T15:49:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123788",
"datePublished": "2026-11-06T21:15:17.807Z",
"dateReserved": "2026-11-06T14:44:36.840Z",
"dateUpdated": "2026-11-06T21:15:17.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119558 (GCVE-0-2026-119558)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-04 22:19
VLAI
EPSS
VEX
Title
OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
Summary
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:18 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/opencart/opencart/blob/4.1.0.4… | technical-description |
| https://github.com/opencart/opencart/blob/4.1.0.4… | technical-description |
| https://abraxaslabs.tech/research/opencart-reward… | third-party-advisory |
| https://github.com/opencart/opencart | product |
| https://www.vulncheck.com/advisories/opencart-thr… | third-party-advisory |
Impacted products
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:18:51.525209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:19:00.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opencart/opencart",
"product": "OpenCart",
"repo": "https://github.com/opencart/opencart",
"vendor": "OpenCart",
"versions": [
{
"lessThanOrEqual": "4.1.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.1.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:07.587Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opencart-reward-free-checkout"
},
{
"tags": [
"product"
],
"url": "https://github.com/opencart/opencart"
},
{
"name": "VulnCheck Advisory: OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points"
}
],
"title": "OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119558",
"datePublished": "2026-10-30T11:31:07.587Z",
"dateReserved": "2026-10-30T10:53:28.953Z",
"dateUpdated": "2026-11-04T22:19:00.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115248 (GCVE-0-2026-115248)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:30 – Updated: 2026-10-29 02:14
VLAI
EPSS
VEX
Title
subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
Summary
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:14 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425221 | vdb-entry |
| https://vuldb.com/vuln/425221/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115248 | third-party-advisory |
| https://vuldb.com/submit/1021709 | third-party-advisory |
| https://github.com/subhajitkhan/online-clinic-man… | exploitissue-tracking |
| https://github.com/subhajitkhan/online-clinic-man… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| subhajitkhan | online-clinic-management-system |
Affected:
e9ee77a8827a1446220fa07ee693dc4d9a29a578
cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115248",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:14:10.267838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:14:19.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Booking Handler"
],
"product": "online-clinic-management-system",
"vendor": "subhajitkhan",
"versions": [
{
"status": "affected",
"version": "e9ee77a8827a1446220fa07ee693dc4d9a29a578"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yuanchao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:30:10.769Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425221 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/425221"
},
{
"name": "VDB-425221 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425221/cti"
},
{
"name": "CVE-2026-115248 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115248"
},
{
"name": "Submit #1021709 | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Client-Side Enforcement of Server-Side Security",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1021709"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/issues/10"
},
{
"tags": [
"product"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-22T10:31:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115248",
"datePublished": "2026-10-22T13:30:10.769Z",
"dateReserved": "2026-10-22T08:26:22.421Z",
"dateUpdated": "2026-10-29T02:14:19.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109231 (GCVE-0-2026-109231)
Vulnerability from cvelistv5 – Published: 2026-10-31 09:29 – Updated: 2026-11-03 19:10
VLAI
EPSS
VEX
Title
Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
Summary
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with "Disable login for unactivated customers" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:09 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
Wordfence
CNA
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vendidero | Germanized for WooCommerce |
Affected:
0 , ≤ 4.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109231",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:09:50.876055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:10:03.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Germanized for WooCommerce",
"vendor": "vendidero",
"versions": [
{
"lessThanOrEqual": "4.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sawyer"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook \u2014 which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account \u2014 only being registered inside the `is_double_opt_in_login_enabled()` branch when \"Disable login for unactivated customers\" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim\u0027s billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker\u0027s account and exposing the original buyer\u0027s billing name, street address, phone number, and purchased items on the attacker\u0027s My Account order page. Exploitation requires the site to have double opt-in enabled with \"Disable login for unactivated customers\" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841 Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T09:29:27.848Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b661e8d7-c50e-4cbf-86a8-3e44d7b61871?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L915"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L88"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L687"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3743210%40woocommerce-germanized\u0026new=3743210%40woocommerce-germanized"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T14:14:46.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-30T21:04:17.000Z",
"value": "Disclosed"
}
],
"title": "Germanized for WooCommerce \u003c= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109231",
"datePublished": "2026-10-31T09:29:27.848Z",
"dateReserved": "2026-10-12T13:59:09.025Z",
"dateUpdated": "2026-11-03T19:10:03.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108789 (GCVE-0-2026-108789)
Vulnerability from cvelistv5 – Published: 2026-10-12 02:15 – Updated: 2026-10-13 14:22
VLAI
EPSS
VEX
Title
deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow
Summary
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:22 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416568 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416568/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108789 | third-party-advisory |
| https://vuldb.com/submit/959699 | third-party-advisory |
| https://github.com/deepseek-ai/deepseek-harness/d… | related |
| https://mcniyfj5bw9b.feishu.cn/docx/M5H6d9AbioNft… | exploit |
| https://github.com/deepseek-ai/deepseek-harness/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| deepseek-ai | deepseek-harness |
Affected:
0.1.1-rc.0
Affected: 0.1.1-rc.1 Affected: 0.1.1-rc.2 cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108789",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:22:30.481471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:22:56.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:*"
],
"modules": [
"dsh-workflow-worker-thread"
],
"product": "deepseek-harness",
"vendor": "deepseek-ai",
"versions": [
{
"status": "affected",
"version": "0.1.1-rc.0"
},
{
"status": "affected",
"version": "0.1.1-rc.1"
},
{
"status": "affected",
"version": "0.1.1-rc.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ShiyuFan_BinYuan (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T02:15:31.636Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416568 | deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416568"
},
{
"name": "VDB-416568 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416568/cti"
},
{
"name": "CVE-2026-108789 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108789"
},
{
"name": "Submit #959699 | \u676d\u5dde\u6df1\u5ea6\u6c42\u7d22\u4eba\u5de5\u667a\u80fd\u57fa\u7840\u6280\u672f\u7814\u7a76\u6709\u9650\u516c\u53f8 DeepSeek Harness 0.1.1-rc.2 \u903b\u8f91\u7f3a\u9677",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/959699"
},
{
"tags": [
"related"
],
"url": "https://github.com/deepseek-ai/deepseek-harness/discussions/243"
},
{
"tags": [
"exploit"
],
"url": "https://mcniyfj5bw9b.feishu.cn/docx/M5H6d9AbioNftYxwk9CchJgGnHc"
},
{
"tags": [
"product"
],
"url": "https://github.com/deepseek-ai/deepseek-harness/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T10:50:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108789",
"datePublished": "2026-10-12T02:15:31.636Z",
"dateReserved": "2026-10-11T08:45:05.631Z",
"dateUpdated": "2026-10-13T14:22:56.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104626 (GCVE-0-2026-104626)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:23 – Updated: 2026-10-07 20:19
VLAI
EPSS
VEX
Title
Gitea fork workflow job revival through later approval
Summary
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:19 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
Gitea
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39399 | patch |
| https://blog.gitea.com/release-of-28.0.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104626",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:19:04.289390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:19:46.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "https://github.com/opensec-intelligence"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/mayank-jangid-moon"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/Kushalkhemka"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/skigeek16"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/nithissh7"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/kewmine"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer\u0027s later approval action, Actions to be enabled, and a runner that accepts the repository\u0027s jobs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841: Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:23:03.330Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-93pj-3x56-5gc2",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2"
},
{
"name": "Fix: go-gitea/gitea pull request #39399",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39399"
},
{
"name": "Gitea 28.0.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.0.0/"
},
{
"name": "go-gitea/gitea v28.0.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0"
}
],
"title": "Gitea fork workflow job revival through later approval"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-104626",
"datePublished": "2026-10-06T19:23:03.330Z",
"dateReserved": "2026-10-04T21:57:35.546Z",
"dateUpdated": "2026-10-07T20:19:46.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103977 (GCVE-0-2026-103977)
Vulnerability from cvelistv5 – Published: 2026-10-14 20:38 – Updated: 2026-10-20 02:10
VLAI
EPSS
VEX
Title
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
Summary
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:10 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/error311/FileRise/security/adv… | x_refsource_CONFIRM |
| https://github.com/error311/FileRise/commit/cc111… | x_refsource_MISC |
| https://github.com/error311/FileRise/releases/tag… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103977",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:10:15.462870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:10:25.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FileRise",
"vendor": "error311",
"versions": [
{
"status": "affected",
"version": "\u003c 3.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account\u0027s valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841: Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:38:39.485Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/error311/FileRise/security/advisories/GHSA-4hfj-6478-5cv7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/error311/FileRise/security/advisories/GHSA-4hfj-6478-5cv7"
},
{
"name": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a"
},
{
"name": "https://github.com/error311/FileRise/releases/tag/v3.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/releases/tag/v3.23.0"
}
],
"source": {
"advisory": "GHSA-4hfj-6478-5cv7",
"discovery": "UNKNOWN"
},
"title": "FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-103977",
"datePublished": "2026-10-14T20:38:39.485Z",
"dateReserved": "2026-10-01T16:09:08.456Z",
"dateUpdated": "2026-10-20T02:10:25.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82423 (GCVE-0-2026-82423)
Vulnerability from cvelistv5 – Published: 2026-08-29 22:15 – Updated: 2026-09-01 02:17
VLAI
EPSS
VEX
Title
macrozheng mall Payment Status Endpoint paySuccess behavioral workflow
Summary
A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 02:17 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397008 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397008/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82423 | third-party-advisory |
| https://vuldb.com/submit/887391 | third-party-advisory |
| https://github.com/macrozheng/mall/issues/985 | issue-tracking |
| https://github.com/macrozheng/mall/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| macrozheng | mall |
Affected:
1.0.0
Affected: 1.0.1 Affected: 1.0.2 Affected: 1.0.3 cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T02:17:19.976903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:17:29.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*"
],
"modules": [
"Payment Status Endpoint"
],
"product": "mall",
"vendor": "macrozheng",
"versions": [
{
"status": "affected",
"version": "1.0.0"
},
{
"status": "affected",
"version": "1.0.1"
},
{
"status": "affected",
"version": "1.0.2"
},
{
"status": "affected",
"version": "1.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "peanutbutter (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T22:15:10.867Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397008 | macrozheng mall Payment Status Endpoint paySuccess behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397008"
},
{
"name": "VDB-397008 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397008/cti"
},
{
"name": "CVE-2026-82423 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82423"
},
{
"name": "Submit #887391 | macrozheng mall 1.0.3 Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/887391"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/macrozheng/mall/issues/985"
},
{
"tags": [
"product"
],
"url": "https://github.com/macrozheng/mall/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-29T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-29T08:34:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "macrozheng mall Payment Status Endpoint paySuccess behavioral workflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82423",
"datePublished": "2026-08-29T22:15:10.867Z",
"dateReserved": "2026-08-29T06:29:17.034Z",
"dateUpdated": "2026-09-01T02:17:29.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.