Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-7608 1Yargs 1Yargs Parser Jun 17, 2026 Mar 16, 2020 N/A· v4 5.3 MEDIUM· v3 4.6 MEDIUM· v2 yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
CVE-2020-7600 1Querymen Project 1Querymen Jun 17, 2026 Mar 12, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollut...Show more querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.Show less
CVE-2020-7598 2Opensuse Substack 2Leap Minimist Oct 8, 2026 Mar 11, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
CVE-2019-10808 1Xcritical.software 1Utilitify Jun 17, 2026 Mar 11, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
CVE-2020-5258 3Debian LinuxfoundationOracle 10Communications Application Session Controller Communications Policy ManagementCommunications Pricing Design Center+7 more Oct 8, 2026 Mar 10, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes,...Show more In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2Show less
CVE-2019-10806 1Vega Project 1Vega Jun 17, 2026 Mar 9, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
CVE-2020-8116 1Dot Prop Project 1Dot Prop Jun 17, 2026 Feb 4, 2020 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
CVE-2019-19919 2Handlebars.js Project Tenable 2Handlebars.js Tenable.sc Jun 17, 2026 Dec 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to exec...Show more Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.Show less
CVE-2019-10768 1Angularjs 1Angularjs Jun 17, 2026 Nov 19, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
CVE-2019-17317 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
CVE-2019-17316 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
CVE-2019-17315 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 7, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
CVE-2019-16328 1Rpyc Project 1Rpyc Jun 17, 2026 Oct 3, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVE-2019-10745 1Assign Deep Project 1Assign Deep Jun 17, 2026 Aug 20, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or...Show more assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.Show less
CVE-2019-14379 7Apple DebianFasterxml+4 more 24Active Iq Unified Manager Banking PlatformCommunications Diameter Signaling Router+21 more Oct 8, 2026 Jul 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex...Show more SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.Show less
CVE-2019-10744 5F5 LodashNetapp+2 more 21Active Iq Unified Manager Banking Extensibility WorkbenchBig Ip Access Policy Manager+18 more Jun 17, 2026 Jul 26, 2019 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2019-11358 11Backdropcms DebianDrupal+8 more 105Agile Product Lifecycle Management For Process Application ExpressApplication Service Level Management+102 more Jun 17, 2026 Apr 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ p...Show more jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.Show less
CVE-2019-9061 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object inje...Show more An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.Show less
CVE-2019-9058 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
CVE-2018-19274 2Debian Phpbb 2Debian Linux Phpbb Nov 21, 2024 Nov 17, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with fo...Show more Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.Show less

Previous 1...28 29 303132 Next