Base de CVEs

CVE-2011-10019 Crítica · 9.8 Exploit público CWE-1321 13/08/2025

Spreecommerce < 0.60.2 Search Parameter RCE

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.

CVE-2025-34146 Alta · 7.0 CWE-1321 31/07/2025

nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox’s executor logic, particularly in the handling of JavaScript function objects returned.

CVE-2021-44906 Crítica · 9.8 CWE-1321 17/03/2022

Prototype Pollution in minimist

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

CVE-2021-23450 Crítica · 9.8 CWE-1321 17/12/2021

Prototype Pollution

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

CVE-2021-23433 Crítica · 9.8 CWE-1321 19/11/2021

Prototype Pollution

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

CVE-2021-23383 Crítica · 9.8 CWE-1321 04/05/2021

Prototype Pollution

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2020-7788 Crítica · 9.8 CWE-1321 11/12/2020

Prototype Pollution

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

CVE-2020-7639 Média · 5.3 CWE-1321 06/04/2020

Prototype Pollution em Dot Project Dot

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

CVE-2020-7598 Média · 5.6 CWE-1321 11/03/2020

Prototype Pollution em Substack Minimist

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVE-2020-5258 Alta · 7.7 CWE-1321 10/03/2020

Prototype pollution in dojo

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

CVE-2019-14379 Crítica · 9.8 CWE-1321 29/07/2019

Prototype Pollution em Fasterxml Jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.