CVE-2026-119558
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by cleari
CVSS
3.1
Low
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-841
Not enough EPSS history yet.
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
- abraxaslabs.techhttps://abraxaslabs.tech/research/opencart-reward-free-checkout
- github.comhttps://github.com/opencart/opencart
- github.comhttps://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94
- github.comhttps://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55
- www.vulncheck.comhttps://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1152485.4 MED16.4%
——5A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.2dCVE-2026-1039778.1 HIG31.5%
——9FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.11dCVE-2026-700797.5 HIG69.8%
——21Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.14dCVE-2026-1087895.5 MED7.1%
——2A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.17dCVE-2026-198786.5 MED14.2%
——4IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.21dCVE-2026-1046268.8 HIG26.5%
——8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.17d