CWE-837 · 18 records

Improper Enforcement of a Single, Unique Action

CVEs in this class

18 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-105850No exploit	Payload: Order confirmation validation issue in Payload Ecommercepayloadcms · payload · CWE-837 Pre-auth	High8.8	—	0.3%	Oct 6, 2026
30Monitor	CVE-2023-6759No exploit	Thecosy IceCMS Love resource improper enforcement of a single, unique actionthecosy · icecms · CWE-837 Pre-auth Denial of service	High7.5	—	0.9%	Dec 13, 2023
30Monitor	CVE-2026-44601No exploit	Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROtorproject · tor · CWE-837 Pre-auth Denial of service	High7.5	—	0.3%	May 7, 2026
28Monitor	CVE-2025-54315No exploit	The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.matrix · matrix specification · CWE-837	High7.1	—	0.3%	Oct 2, 2025
26Monitor	CVE-2024-4629No exploit	Keycloak: potential bypass of brute force protectionredhat · keycloak · CWE-837 Pre-auth	Medium6.5	—	0.7%	Sep 3, 2024
26Monitor	CVE-2024-11301No exploit	Improper Enforcement of Unique Constraint in lunary-ai/lunarylunary · lunary · CWE-837	Medium6.5	—	0.5%	Mar 20, 2025
26Monitor	CVE-2025-58135No exploit	Zoom Workplace Clients for Windows - Improper Action Enforcementzoom · meeting software development kit · CWE-837 Pre-auth	Medium6.5	—	0.2%	Sep 9, 2025
25Monitor	CVE-2024-11717No exploit	Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations.ctfd · ctfd · CWE-837 Pre-auth	Medium6.3	—	0.6%	Jan 2, 2025
24Monitor	CVE-2024-11716No exploit	While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation alctfd · ctfd · CWE-837	Medium5.3	—	11.5%	Jan 2, 2025
23Monitor	CVE-2025-62782No exploit	InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElementphoenix616 · inventorygui · CWE-837	Medium5.9	—	0.2%	Oct 27, 2025
21Monitor	CVE-2023-6438No exploit	Thecosy IceCMS Like improper enforcement of a single, unique actionthecosy · icecms · CWE-837 Pre-auth Denial of service	Medium5.3	—	0.7%	Nov 30, 2023
21Monitor	CVE-2026-45734No exploit	MyBB: Default CAPTCHA missing invalidationmybb · mybb · CWE-837 Pre-auth	Medium5.3	—	0.5%	Aug 18, 2026
21Monitor	CVE-2026-112285No exploit	Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Ordersthelia · thelia · CWE-837	Medium5.3	—	0.2%	6 days ago
21Monitor	CVE-2025-62784No exploit	InventoryGui allows item duplication in GUIs which use GuiStorageElementphoenix616 · inventorygui · CWE-837	Medium5.3	—	0.2%	Oct 27, 2025
17Monitor	CVE-2025-62783No exploit	InventoryGui affected by item duplication in GUIs which use GuiStorageElementphoenix616 · inventorygui · CWE-837	Medium4.3	—	0.2%	Oct 27, 2025
14Monitor	CVE-2023-6467No exploit	Thecosy IceCMS Comment Like improper enforcement of a single, unique actionthecosy · icecms · CWE-837 Pre-auth	Low3.7	—	0.6%	Dec 2, 2023
14Monitor	CVE-2023-5313No exploit	phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique actionphpkobo · ajax poll script · CWE-837 Pre-auth	Low3.7	—	0.5%	Sep 30, 2023
9Monitor	CVE-2026-86198No exploit	PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacketpmmp · pocketmine-mp · CWE-837	Low2.3	—	0.3%	Sep 9, 2026

CVE-2026-105850
35Monitor
Payload: Order confirmation validation issue in Payload Ecommerce
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
payloadcms · payloadOct 6, 2026
CVE-2023-6759
30Monitor
Thecosy IceCMS Love resource improper enforcement of a single, unique action
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
thecosy · icecmsDec 13, 2023
CVE-2026-44601
30Monitor
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TRO
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
torproject · torMay 7, 2026
CVE-2025-54315
28Monitor
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
HighCVSS 7.1No exploitEPSS 0%
matrix · matrix specificationOct 2, 2025
CVE-2024-4629
26Monitor
Keycloak: potential bypass of brute force protection
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
redhat · keycloakSep 3, 2024
CVE-2024-11301
26Monitor
Improper Enforcement of Unique Constraint in lunary-ai/lunary
MediumCVSS 6.5No exploitEPSS 0%
lunary · lunaryMar 20, 2025
CVE-2025-58135
26Monitor
Zoom Workplace Clients for Windows - Improper Action Enforcement
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
zoom · meeting software development kitSep 9, 2025
CVE-2024-11717
25Monitor
Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations.
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
ctfd · ctfdJan 2, 2025
CVE-2024-11716
24Monitor
While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation al
MediumCVSS 5.3No exploitEPSS 11%
ctfd · ctfdJan 2, 2025
CVE-2025-62782
23Monitor
InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement
MediumCVSS 5.9No exploitEPSS 0%
phoenix616 · inventoryguiOct 27, 2025
CVE-2023-6438
21Monitor
Thecosy IceCMS Like improper enforcement of a single, unique action
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Denial of service
thecosy · icecmsNov 30, 2023
CVE-2026-45734
21Monitor
MyBB: Default CAPTCHA missing invalidation
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
mybb · mybbAug 18, 2026
CVE-2026-112285
21Monitor
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
MediumCVSS 5.3No exploitEPSS 0%
thelia · thelia6 days ago
CVE-2025-62784
21Monitor
InventoryGui allows item duplication in GUIs which use GuiStorageElement
MediumCVSS 5.3No exploitEPSS 0%
phoenix616 · inventoryguiOct 27, 2025
CVE-2025-62783
17Monitor
InventoryGui affected by item duplication in GUIs which use GuiStorageElement
MediumCVSS 4.3No exploitEPSS 0%
phoenix616 · inventoryguiOct 27, 2025
CVE-2023-6467
14Monitor
Thecosy IceCMS Comment Like improper enforcement of a single, unique action
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
thecosy · icecmsDec 2, 2023
CVE-2023-5313
14Monitor
phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
phpkobo · ajax poll scriptSep 30, 2023
CVE-2026-86198
9Monitor
PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
LowCVSS 2.3No exploitEPSS 0%
pmmp · pocketmine-mpSep 9, 2026

All vulnerability classes