Weaknesses of type CWE-841

91 results

Falta de Aplicação de Fluxo de Comportamento

Ocorre quando a aplicação não valida ou não força a ordem correta de operações que deveriam seguir um fluxo pré-definido. Um usuário pode pular etapas, executar ações fora da sequência esperada ou contornar regras de negócio, alterando o estado do sistema de forma indevida.

Example

Um sistema de compras que deveria exigir: (1) adicionar item ao carrinho, (2) informar endereço, (3) selecionar pagamento, (4) confirmar pedido. Se a aplicação não valida essas etapas no servidor, um atacante pode enviar uma requisição direto à etapa (4) sem passar pelas anteriores, criando pedidos sem endereço ou com valores manipulados.

How to mitigate

Implemente validação de estado no servidor: cada operação deve verificar se o usuário está na etapa correta antes de prosseguir. Use máquinas de estado (finite state machines) para modelar transições permitidas e rejeite requisições que violem o fluxo esperado. Nunca confie na ordem de execução do lado cliente.

CVE-2025-2323MEDIUM274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflowEPSS 0.5%CVE-2026-43937HIGHYAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`EPSS 0.5%CVE-2026-43974HIGHgun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOMEPSS 0.5%CVE-2025-48478HIGHFreeScout Has Business Logic ErrorsEPSS 0.5%CVE-2024-0410HIGHImproper Enforcement of Behavioral Workflow in GitLabEPSS 0.5%CVE-2024-46307HIGHA loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.EPSS 0.5%CVE-2025-13459LOWIBM Aspera Console Denial of ServiceEPSS 0.4%CVE-2026-113165HIGHInappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renEPSS 0.4%CVE-2026-82423MEDIUMmacrozheng mall Payment Status Endpoint paySuccess behavioral workflowEPSS 0.4%CVE-2026-82406HIGHKlever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceEPSS 0.4%CVE-2026-30783MEDIUMRustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL PoliciesEPSS 0.4%CVE-2026-78618MEDIUMDimension Business Logic Flaw Allows Chained Backend Object OperationsEPSS 0.4%CVE-2024-39325MEDIUMaimeos/ai-controller-frontend doesn't reset payment status in basketEPSS 0.4%CVE-2026-19208MEDIUMWonderTrader TraderDD.cpp queryTrades behavioral workflowEPSS 0.4%CVE-2026-78135MEDIUMlibcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are EPSS 0.4%CVE-2026-103977HIGHFileRise: Session-scoped TOTP rate limiting permits repeated verification attemptsEPSS 0.4%CVE-2026-113308HIGHInappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procEPSS 0.4%CVE-2026-109231MEDIUMGermanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email ChangeEPSS 0.4%CVE-2026-19037MEDIUMWonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflowEPSS 0.4%CVE-2026-19993MEDIUMWebkul Bagisto RMA State Validation update-status behavioral workflowEPSS 0.4%