CWE-602

CWE-602 · 3 records · 2 with a public proof-of-concept

Records the NVD classes under CWE-602, highest CVSS first.

  1. HIGH 8.6CVE-2026-131382026-10-13

    Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 5.3CVE-2026-100306public PoC2026-09-25

    TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by us…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 5.3CVE-2026-77320public PoC2026-09-24

    TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the ma…

    AI risk analysis on Exploit-DB.ai →