Weaknesses of type CWE-840

108 results

Erros de Lógica de Negócio

Fraqueza que ocorre quando a implementação não respeita corretamente as regras de negócio, permitindo estados ou operações que não deveriam ser possíveis. O código pode estar tecnicamente correto (sem buffer overflow, injeção etc), mas executa fluxos que violam as restrições do domínio, levando a fraudes, escalação de privilégios ou corrupção de dados.

Example

Um e-commerce que permite aplicar desconto infinitas vezes no carrinho porque falta validação de regra de negócio; ou um sistema de transferência bancária que permite débito sem verificar saldo mínimo exigido pela política institucional. O código roda sem erros, mas o negócio é prejudicado.

How to mitigate

Modele explicitamente as regras de negócio (ex: pré-condições, limites, sequências permitidas) e implemente validações em cada ponto crítico; revise fluxos com especialistas do domínio durante design e testes, não apenas verificando segurança técnica, mas coerência com políticas operacionais.

CVE-2026-105573MEDIUMnewbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic errorEPSS 0.2%CVE-2026-116461MEDIUMOmega Solution Restro POS sale-invoice logic errorEPSS 0.2%CVE-2026-11465LOWsongquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic errorEPSS 0.2%CVE-2026-4547MEDIUMmickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic errorEPSS 0.2%CVE-2024-51523HIGHInformation management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidenEPSS 0.2%CVE-2026-108789MEDIUMdeepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflowEPSS 0.2%CVE-2024-54098HIGHService logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service inteEPSS 0.2%CVE-2024-56449MEDIUMPrivilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.2%CVE-2024-32999MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2024-4046MEDIUMCracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-41965MEDIUMUse-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-58558HIGHPermission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2024-39671CRITICALAccess control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-58043HIGHPermission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2026-41966MEDIUMPermission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confEPSS 0.1%CVE-2025-54606HIGHStatus verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability EPSS 0.1%CVE-2024-42034MEDIUMLaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-54611HIGHEXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2023-7271MEDIUMPrivilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2024-58046MEDIUMPermission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%