Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-7706 1Connie Lang Project 1Connie Lang Jun 17, 2026 Aug 18, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
CVE-2020-7704 1Linux Cmdline Project 1Linux Cmdline Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
CVE-2020-7703 1Nis Utils Project 1Nis Utils Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
CVE-2020-7702 1Templ8 Project 1Templ8 Jun 17, 2026 Aug 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
CVE-2020-7701 1Springtree 1Madlib Object Utils Jun 17, 2026 Aug 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
CVE-2020-7700 1Php.js Project 1Php.js Jun 17, 2026 Aug 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
CVE-2020-7699 2Express Fileupload Project Netapp 2Express Fileupload Max Data Jun 17, 2026 Jul 30, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVE-2020-15366 1Ajv.js 1Ajv Jun 17, 2026 Jul 15, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted...Show more An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)Show less
CVE-2020-8203 2Lodash Oracle 18Banking Corporate Lending Process Management Banking Credit Facilities Process ManagementBanking Extensibility Workbench+15 more Jun 17, 2026 Jul 15, 2020 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-7679 1Casperjs 1Casperjs Jun 17, 2026 Jun 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
CVE-2020-11066 1Typo3 1Typo3 Jun 17, 2026 May 14, 2020 N/A· v4 10.0 CRITICAL· v3 6.4 MEDIUM· v2 In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically...Show more In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in the file system, if it is writable for the web server. It can also trigger message submission via email using the identity of the web site (mail relay). Another insecure deserialization vulnerability is required to actually exploit mentioned aspects. This has been fixed in 9.5.17 and 10.4.2.Show less
CVE-2020-7644 1Fun Map Project 1Fun Map Jun 17, 2026 Apr 28, 2020 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVE-2020-7643 1Idea 1Paypal Adaptive Jun 17, 2026 Apr 23, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2020-12079 1Beakerbrowser 1Beaker Jun 17, 2026 Apr 23, 2020 N/A· v4 10.0 CRITICAL· v3 7.5 HIGH· v2 Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack again...Show more Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API.Show less
CVE-2020-7618 1Sds Project 1Sds Jun 17, 2026 Apr 7, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
CVE-2020-7616 1Express Mock Middleware Project 1Express Mock Middleware Jun 17, 2026 Apr 7, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerabili...Show more express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.Show less
CVE-2020-7639 1Dot Project 1Dot Oct 8, 2026 Apr 6, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVE-2020-7638 1Confinit Project 1Confinit Jun 17, 2026 Apr 6, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
CVE-2020-7637 1Class Transformer Project 1Class Transformer Jun 17, 2026 Apr 6, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVE-2020-7617 1Ini Parser Project 1Ini Parser Jun 17, 2026 Apr 2, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.

Previous 1...28 293031 32 Next