Browse / Business Logic

Business Logic

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Business Logic Errors415
• Time-of-check Time-of-use (TOCTOU) Race Condition25
• Modification of Assumed-Immutable Data (MAID)19
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')18
• Expected Behavior Violation4
• External Control of Critical State Data3
• Incorrect Comparison2
• Leveraging Race Conditions1
• Partial String Comparison1

Often found together with

• Misconfiguration48
• Denial of Service38
• Information Disclosure37

Most upvoted Business Logic reports

AllValidInformativeN/ADuplicate

1. [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposureInformativeBusiness Logic Errors · BlockDev Sp. Z o.o
   140 votes
2. Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computerInformativeBusiness Logic Errors · HackerOne
   91 votes
3. Exposure of shopify employee summit page allows anonymous user to place orders for free booksInformativeBusiness Logic Errors · Shopify
   76 votes
4. Incorrect logic when buy one more license which may lead to extend the expire date of existing licenseInformativeBusiness Logic Errors · PortSwigger Web Security
   61 votes
5. captcha bypass leads to register multiple user with one valid captchaInformativeBusiness Logic Errors · medium · Tennessee Valley Authority
   50 votes
6. Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)InformativeTime-of-check Time-of-use (TOCTOU) Race Condition · high · Node.js
   32 votes
7. Schannel custom-CA path skips Extended Key Usage enforcementInformativeBusiness Logic Errors · curl
   30 votes
8. Curl_compareheader() fails to match multi-value HTTP headersInformativeExpected Behavior Violation · medium · curl
   28 votes
9. Arbitrary free in curl's config file parsing.InformativeBusiness Logic Errors · low · curl
   26 votes
10. Creating Unlimited Fake Accounts.InformativeBusiness Logic Errors · medium · Khan Academy
    26 votes
11. curl ASSERTs when accessing an LDAP URLInformativeBusiness Logic Errors · curl
    24 votes
12. Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNSInformativeConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium · curl
    23 votes
13. [SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File AppendInformativeTime-of-check Time-of-use (TOCTOU) Race Condition · medium · curl
    23 votes
14. Multiple Vulnerabilities in (*.blog.yelp.com) - Leakage user admin Sensitive ExposureInformativeBusiness Logic Errors · Yelp
    23 votes
15. 2FA requirement bypass when claiming bounty InformativeBusiness Logic Errors · HackerOne
    22 votes
16. PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic FlawInformativeBusiness Logic Errors · high · curl
    19 votes
17. When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctlyInformativeBusiness Logic Errors · medium · curl
    19 votes
18. Business Logic, currency arbitrage - Possibility to pay less than the price in USDInformativeBusiness Logic Errors · medium · PortSwigger Web Security
    18 votes
19. Bypassing the Grammarly plagiarism checker by simply replacing characters in the source textInformativeBusiness Logic Errors · Superhuman (formerly Grammarly)
    18 votes
20. Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurlInformativeConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium · curl
    17 votes
21. CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple buildsInformativeBusiness Logic Errors · curl
    15 votes
22. unclaimed s3 bucket takeover in the 3 js file located on the github page of brave softwareInformativeBusiness Logic Errors · low · Brave Software
    15 votes
23. cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct pathsInformativeBusiness Logic Errors · curl
    13 votes
24. No rate limit on subscribe form InformativeBusiness Logic Errors · medium · Yelp
    13 votes
25. Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN matchInformativeBusiness Logic Errors · curl
    10 votes
26. ignoring 'options' when doing connection reuseInformativeIncorrect Comparison · curl
    9 votes
27. WebSocket Logic Error: Control Frame (PING/PONG) Starvation causes Connection Drop (DoS) during large transfersInformativeBusiness Logic Errors · medium · curl
    9 votes
28. Cache purge requests are not authenticatedInformativeBusiness Logic Errors · medium · curl
    9 votes
29. No rate limiting for confirmation email lead to huge Mass mailingsInformativeBusiness Logic Errors · medium · Stripo Inc
    9 votes
30. Manipulate Uneditable Messages in SupportInformativeBusiness Logic Errors · high · CS Money
    9 votes
31. rustls backend silently ignores CURLOPT_CRLFILE when native CA store is activeInformativeBusiness Logic Errors · curl
    8 votes
32. CORS misconfigurationInformativeBusiness Logic Errors · Sifchain
    8 votes
33. TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0InformativeBusiness Logic Errors · curl
    7 votes
34. curl file writing susceptible to symlink attacksInformativeBusiness Logic Errors · low · curl
    7 votes
35. SignUp With Fake EmailInformativeBusiness Logic Errors · medium · Khan Academy
    7 votes
36. Business Logic Flaw allowing Privilege EscalationInformativeBusiness Logic Errors · Inflection
    7 votes
37. libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypassInformativeBusiness Logic Errors · low · curl
    4 votes
38. Flaws In Social media Icon on error page which can lead to financial loss to a company.InformativeBusiness Logic Errors · Sifchain
    4 votes
39. IDOR in locid parameter allowing to view others accounts Profile Locations InformativeBusiness Logic Errors · low · Yelp
    4 votes
40. SignUp using Fake EmailInformativeBusiness Logic Errors · Nextcloud
    4 votes
41. Call back number not verifiedInformativeBusiness Logic Errors · Airbnb
    4 votes
42. Adding Used Primary Email Address to attacker account and Account takeoverInformativeBusiness Logic Errors · Gratipay
    3 votes
43. Running 2 accounts with a single emailInformativeBusiness Logic Errors · WakaTime
    3 votes
44. Proxy CONNECT response poisoning via authentication retry in cf-h1-proxy.c (libcurl)InformativeBusiness Logic Errors · medium · curl
    2 votes
45. File System Monitoring Queue OverflowInformativeBusiness Logic Errors · low · ownCloud
    2 votes
46. Opportunity to post hidden commentsInformativeBusiness Logic Errors · critical · X / xAI
    2 votes
47. A single user can subscribe a community multiple timesInformativeBusiness Logic Errors · Liberapay
    2 votes
48. REGISTRATION USING FAKE EMAIL ACCOUNTInformativeBusiness Logic Errors · Liberapay
    2 votes
49. Bypass hide download Nextcloud ShareInformativeBusiness Logic Errors · high · Nextcloud
    1 votes
50. Internal loop going to infinite for cb.setTimeout(func, msecs) for broadcast app.InformativeBusiness Logic Errors · Chaturbate
    1 votes
51. No Data Validation, No Captcha, No Filters...InformativeBusiness Logic Errors · Liberapay
    1 votes
52. Punny code Detection Parsing should be implemented on Markdown InformativeBusiness Logic Errors · Liberapay
    1 votes
53. Design Issue at riders.uber.com/profileInformativeBusiness Logic Errors · Uber
    1 votes
54. Unsubscribe Any UserInformativeBusiness Logic Errors · Inflection
    1 votes
55. Inaccurate Payment receipt InformativeBusiness Logic Errors · Coinbase
    1 votes