Common Weakness Enumeration
CWE-841
AllowedImproper Enforcement of Behavioral Workflow
Abstraction: Class · Status: Incomplete
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
107 vulnerabilities reference this CWE, most recent first.
GHSA-62MF-VHHW-XMF8
Vulnerability from github – Published: 2025-05-23 16:11 – Updated: 2025-05-23 18:46
VLAI
Summary
DNN site Import could use an external source with a crafted request
Details
A malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported.
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "DotNetNuke.SiteExportImport"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.13.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48376"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-23T16:11:14Z",
"nvd_published_at": "2025-05-23T16:15:27Z",
"severity": "LOW"
},
"details": "A malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported.",
"id": "GHSA-62mf-vhhw-xmf8",
"modified": "2025-05-23T18:46:09Z",
"published": "2025-05-23T16:11:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48376"
},
{
"type": "WEB",
"url": "https://github.com/dnnsoftware/Dnn.Platform/commit/13fb13ee76173c3467d7ee8d120b20ca7bd4fa63"
},
{
"type": "PACKAGE",
"url": "https://github.com/dnnsoftware/Dnn.Platform"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "DNN site Import could use an external source with a crafted request"
}
GHSA-6C67-GMX4-F33H
Vulnerability from github – Published: 2026-08-28 03:31 – Updated: 2026-08-28 03:31
VLAI
Details
WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first completing the UI unlock step. This allows an authenticated read-write administrator session to bypass the intended editing workflow and overwrite configuration changes being made by another concurrent administrator session.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-78103"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T02:16:22Z",
"severity": "MODERATE"
},
"details": "WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first completing the UI unlock step. This allows an authenticated read-write administrator session to bypass the intended editing workflow and overwrite configuration changes being made by another concurrent administrator session.",
"id": "GHSA-6c67-gmx4-f33h",
"modified": "2026-08-28T03:31:24Z",
"published": "2026-08-28T03:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78103"
},
{
"type": "WEB",
"url": "https://psirt.watchguard.com/CVE-2026-78103"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6XPP-JM6C-3V96
Vulnerability from github – Published: 2023-08-06 09:30 – Updated: 2023-08-06 09:30
VLAI
Details
A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-4181"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-06T09:15:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216.",
"id": "GHSA-6xpp-jm6c-3v96",
"modified": "2023-08-06T09:30:18Z",
"published": "2023-08-06T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4181"
},
{
"type": "WEB",
"url": "https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/vertical%20privilege%20escalation/vuln.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.236216"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.236216"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7J6Q-QXMG-PQP2
Vulnerability from github – Published: 2024-06-18 21:30 – Updated: 2024-09-21 00:34
VLAI
Details
A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout of the component Checkout Page. The manipulation of the argument quantity with the input -10 leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268895.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-6128"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-18T21:15:56Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout of the component Checkout Page. The manipulation of the argument quantity with the input -10 leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268895.",
"id": "GHSA-7j6q-qxmg-pqp2",
"modified": "2024-09-21T00:34:48Z",
"published": "2024-06-18T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6128"
},
{
"type": "WEB",
"url": "https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2024/Jun/6"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.268895"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.268895"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7M73-XQJH-9675
Vulnerability from github – Published: 2026-08-26 18:31 – Updated: 2026-08-26 18:31
VLAI
Details
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-15365"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T07:16:45Z",
"severity": "LOW"
},
"details": "A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.",
"id": "GHSA-7m73-xqjh-9675",
"modified": "2026-08-26T18:31:54Z",
"published": "2026-08-26T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15365"
},
{
"type": "WEB",
"url": "https://www.vivo.com/en/support/security-advisory-detail?id=25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8XGV-33F9-23FM
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-55330"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:45Z",
"severity": "MODERATE"
},
"details": "Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.",
"id": "GHSA-8xgv-33f9-23fm",
"modified": "2025-10-14T18:30:30Z",
"published": "2025-10-14T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55330"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55330"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-96FR-RV8Q-2885
Vulnerability from github – Published: 2025-12-01 15:30 – Updated: 2026-06-04 09:30
VLAI
Details
Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım allows Functionality Misuse.This issue affects Onaylarım: from 25.09.26.01 through 18112025.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-13129"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-01T15:15:48Z",
"severity": "LOW"
},
"details": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.This issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025.",
"id": "GHSA-96fr-rv8q-2885",
"modified": "2026-06-04T09:30:33Z",
"published": "2025-12-01T15:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13129"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0422"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0422"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C537-PF3W-23P5
Vulnerability from github – Published: 2024-02-21 09:31 – Updated: 2025-11-04 21:31
VLAI
Details
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private browsing activity may be unexpectedly saved in the App Privacy Report.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-42939"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T07:15:50Z",
"severity": "LOW"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user\u0027s private browsing activity may be unexpectedly saved in the App Privacy Report.",
"id": "GHSA-c537-pf3w-23p5",
"modified": "2025-11-04T21:31:11Z",
"published": "2024-02-21T09:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42939"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213982"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213982"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C7XW-P58W-H6FJ
Vulnerability from github – Published: 2023-07-18 19:12 – Updated: 2023-07-18 19:12
VLAI
Summary
Keycloak: Impersonation and lockout possible through incorrect handling of email trust
Details
Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "22.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-0105"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-841"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-18T19:12:28Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.",
"id": "GHSA-c7xw-p58w-h6fj",
"modified": "2023-07-18T19:12:28Z",
"published": "2023-07-18T19:12:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-0105"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158910"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Impersonation and lockout possible through incorrect handling of email trust"
}
GHSA-CXRR-H279-673F
Vulnerability from github – Published: 2024-01-11 00:30 – Updated: 2024-01-17 18:31
VLAI
Details
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-46710"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-10T22:15:47Z",
"severity": "MODERATE"
},
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.",
"id": "GHSA-cxrr-h279-673f",
"modified": "2024-01-17T18:31:35Z",
"published": "2024-01-11T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46710"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213530"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213532"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.