CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- chimurai http-proxy-middlewareArbitrary Code Execution in handlebars4.0 Medium
- cure53 dompurifyArbitrary Code Execution in handlebars4.5 Medium
- cure53 dompurifyDOMPurify nesting-based mXSS10.0 Critical
- cure53 dompurifyTampering by prototype polution in DOMPurify7.3 High
- log4js-node, log4js project log4js, debian linux +2 moreIncorrect Default Permissions in log4js-node5.5 Medium
- handlebarsjs handlebars, netapp e-series performance analyzer +1 morePrototype Pollution5.6 Medium
- handlebarsjs handlebarsRemote Code Execution (RCE)5.6 Medium
- handlebarsjs handlebarsArbitrary Code Execution in handlebars8.1 High
- handlebars.js project handlebars.js, tenable tenable.sc +1 moreArbitrary Code Execution in handlebars9.8 Critical
- nodeca js-yamljs-yaml has prototype pollution in merge (<<)5.3 Medium
- backdropcms backdrop, drupal, jquery +102 more +104 moreXSS in jQuery as used in Drupal, Backdrop CMS, and other products6.1 Medium
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action...8.8 High
- cmsmadesimple cms made simpleAn issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm...7.2 High
- hackerone mpathPrototype Pollution in mpath7.5 High
- hackerone just-extendPrototype Pollution in just-extend9.8 Critical
- phpbb, debian linux +1 morephpBB Remote Code Execution7.2 High
- phpmailer project phpmailer, debian linux, fedoraproject fedora +1 more +3 morePhar object injection in PHPMailer8.8 High
- brikcss mergePrototype Pollution in merge7.5 High
- merge-object project merge-objectPrototype Pollution in async merge-object9.8 Critical
- hackerone lodash node module, lodash, netapp active iq unified manager +1 more +3 morePrototype Pollution in lodash6.5 Medium
- assign-deep project assign-deep, hackerone assign-deep node module +1 morePrototype Pollution in assign-deep8.8 High
- quest kace system management applianceThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318...8.8 High
- hapi hoek node module, hapijs hoek +1 morePrototype Pollution in hoek8.8 High
- splashing images project imagesadmin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images)...7.2 High
- handlebars.js project handlebars.jsArbitrary Code Execution in handlebars6.1 Medium