Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (536)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-10768 1Angularjs 1Angularjs Jun 17, 2026 Nov 19, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
CVE-2019-17317 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
CVE-2019-17316 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
CVE-2019-17315 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
CVE-2019-16328 1Rpyc Project 1Rpyc Jun 17, 2026 Oct 3, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVE-2019-10745 1Assign Deep Project 1Assign Deep Jun 17, 2026 Aug 20, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or...Show more assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.Show less
CVE-2019-14379 7Apple DebianFasterxml+4 more 24Active Iq Unified Manager Banking PlatformCommunications Diameter Signaling Router+21 more Jun 17, 2026 Jul 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex...Show more SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.Show less
CVE-2019-10744 5F5 LodashNetapp+2 more 21Active Iq Unified Manager Banking Extensibility WorkbenchBig Ip Access Policy Manager+18 more Jun 17, 2026 Jul 26, 2019 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2019-11358 11Backdropcms DebianDrupal+8 more 105Agile Product Lifecycle Management For Process Application ExpressApplication Service Level Management+102 more Jun 17, 2026 Apr 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ p...Show more jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.Show less
CVE-2019-9061 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object inje...Show more An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.Show less
CVE-2019-9058 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
CVE-2018-19274 2Debian Phpbb 2Debian Linux Phpbb Nov 21, 2024 Nov 17, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with fo...Show more Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.Show less
CVE-2018-19296 4Debian FedoraprojectPhpmailer Project+1 more 4Debian Linux FedoraPhpmailer+1 more Nov 21, 2024 Nov 16, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
CVE-2018-3721 2Lodash Netapp 3Active Iq Unified Manager LodashSystem Manager Nov 21, 2024 Jun 7, 2018 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Obje...Show more lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.Show less
CVE-2018-11135 1Quest 1Kace System Management Appliance Nov 21, 2024 May 31, 2018 N/A· v4 8.8 HIGH· v3 6.0 MEDIUM· v2 The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.
CVE-2018-6195 1Splashing Images Project 1Splashing Images Jun 17, 2026 Jan 30, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object In...Show more admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.Show less

Previous 1...23 24 25 2627