CWE-602
CWE-602 · 13 records · 5 with a public proof-of-concept
Records the NVD classes under CWE-602, highest CVSS first.
- HIGH 8.6CVE-2026-13138
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.
- MEDIUM 6.3CVE-2026-89206
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with mi…
- MEDIUM 6.3CVE-2026-89205
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal priv…
- MEDIUM 5.9CVE-2026-119746
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remo…
- MEDIUM 5.3CVE-2026-116605public PoC
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possi…
- MEDIUM 5.3CVE-2026-100306public PoC
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by us…
- MEDIUM 5.3CVE-2026-77320public PoC
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the ma…
- MEDIUM 4.3CVE-2026-112369
IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
- MEDIUM 4.3CVE-2026-117554public PoC
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat c…
- UNSCOREDCVE-2026-118795
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
- UNSCOREDCVE-2026-122148
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related int…
- UNSCOREDCVE-2026-89293
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling t…
- UNSCOREDCVE-2026-110314public PoC
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring th…