CWE-915 · 121 records

Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVEs in this class

121 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
47Plan	CVE-2024-5452Proof of concept	RCE via Property/Class Pollution in lightning-ai/pytorch-lightninglightningai · pytorch lightning · CWE-915 pre-auth RCE Deserialization	Critical9.8	—	26.8%	Jun 6, 2024
43Plan	CVE-2026-33453Proof of concept	Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Executionapache · camel · CWE-915 pre-auth RCE	Critical10.0	—	9.1%	Apr 27, 2026
41Plan	CVE-2026-50160Proof of concept	Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwritehoppscotch · hoppscotch · CWE-915 Pre-auth	Critical10.0	—	1.7%	Jul 1, 2026
40Plan	CVE-2022-43441No exploit	A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.ghost · sqlite3 · CWE-915 pre-auth RCE	Critical9.8	—	2.3%	Mar 16, 2023
40Plan	CVE-2021-21304No exploit	Prototype Pollution in Dynamoosedynamoosejs · dynamoose · CWE-915 Pre-auth Prototype pollution	Critical9.8	—	1.8%	Feb 8, 2021
40Plan	CVE-2022-24802No exploit	Prototype Pollution in deepmerge-tsdeepmerge-ts project · deepmerge-ts · CWE-915 Pre-auth Prototype pollution	Critical9.8	—	1.6%	Mar 31, 2022
40Plan	CVE-2020-11066No exploit	Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMStypo3 · typo3 · CWE-915 Pre-auth Deserialization	Critical10.0	—	1.5%	May 13, 2020
40Plan	CVE-2025-58367No exploit	DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionseperman · deepdiff · CWE-915 pre-auth RCE Deserialization	Critical10.0	—	1.1%	Sep 5, 2025
39Monitor	CVE-2022-31106No exploit	Prototype Pollution in underscore.deepclever · underscore.deep · CWE-915 Pre-auth Prototype pollution	Critical9.8	—	1.0%	Jun 28, 2022
39Monitor	CVE-2024-55638No exploit	Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008drupal · drupal · CWE-915 pre-auth RCE Deserialization	Critical9.8	—	0.9%	Dec 9, 2024
39Monitor	CVE-2024-55636No exploit	Drupal core - Less critical - Gadget chain - SA-CORE-2024-006drupal · drupal · CWE-915 pre-auth RCE Deserialization	Critical9.8	—	0.9%	Dec 9, 2024
39Monitor	CVE-2024-55637No exploit	Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007drupal · drupal · CWE-915 pre-auth RCE Deserialization	Critical9.8	—	0.8%	Dec 9, 2024
39Monitor	CVE-2026-9726No exploit	Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038alternativecommerce · alternativecommerce · CWE-915 Pre-auth	Critical9.8	—	0.5%	Jul 10, 2026
39Monitor	CVE-2026-12535No exploit	Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048zroger · formatter field · CWE-915 Pre-auth	Critical9.8	—	0.5%	Jul 10, 2026
38Monitor	CVE-2026-54351No exploit	Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Overridebudibase · budibase · CWE-915	Critical9.6	—	0.4%	Jun 26, 2026
37Monitor	CVE-2026-72710No exploit	SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injectionspip · spip · CWE-915 pre-auth RCE	Critical9.3	—	1.1%	Sep 11, 2026
37Monitor	CVE-2025-2304Proof of concept	Camaleon CMS Privilege Escalationowen2345 · camaleon-cms · CWE-915	Critical9.4	—	0.6%	Mar 14, 2025
37Monitor	CVE-2026-34406No exploit	APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpointaptrs · aptrs · CWE-915	Critical9.4	—	0.5%	Mar 31, 2026
37Monitor	CVE-2025-24370No exploit	Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypassadamghill · django-unicorn · CWE-915 Pre-auth Auth bypass XSS	Critical9.3	—	0.4%	Feb 3, 2025
36Monitor	CVE-2024-0404No exploit	Mass Assignment Vulnerability in mintplex-labs/anything-llmmintplexlabs · anythingllm · CWE-915 Pre-auth	Critical9.1	—	0.7%	Apr 15, 2024
36Monitor	CVE-2026-42044No exploit	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`axios · axios · CWE-915 Pre-auth Prototype pollution	Critical9.1	—	0.6%	Apr 24, 2026
36Monitor	CVE-2026-92119No exploit	Apache Allura: REST API Mass Assignmentapache software foundation · apache allura · CWE-915 Pre-auth	Critical9.1	—	0.3%	Oct 12, 2026
36Monitor	CVE-2026-48150No exploit	Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignbudibase · budibase · CWE-915	Critical9.0	—	0.2%	May 27, 2026
36Monitor	CVE-2026-34179No exploit	Update of type field in restricted TLS certificate allows privilege escalation to cluster admincanonical · lxd · CWE-915	Critical9.1	—	0.2%	Apr 9, 2026
35Monitor	CVE-2021-21368No exploit	msgpack5 is a msgpack v5 implementation for node.js and the browser.msgpack5 project · msgpack5 · CWE-915	High8.8	—	1.6%	Mar 12, 2021

CVE-2024-5452
47Plan
RCE via Property/Class Pollution in lightning-ai/pytorch-lightning
CriticalCVSS 9.8Proof of conceptEPSS 26%
- pre-auth RCE
- Deserialization
lightningai · pytorch lightningJun 6, 2024
CVE-2026-33453
43Plan
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
CriticalCVSS 10.0Proof of conceptEPSS 9%
- pre-auth RCE
apache · camelApr 27, 2026
CVE-2026-50160
41Plan
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
CriticalCVSS 10.0Proof of conceptEPSS 1%
- Pre-auth
hoppscotch · hoppscotchJul 1, 2026
CVE-2022-43441
40Plan
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
ghost · sqlite3Mar 16, 2023
CVE-2021-21304
40Plan
Prototype Pollution in Dynamoose
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Prototype pollution
dynamoosejs · dynamooseFeb 8, 2021
CVE-2022-24802
40Plan
Prototype Pollution in deepmerge-ts
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Prototype pollution
deepmerge-ts project · deepmerge-tsMar 31, 2022
CVE-2020-11066
40Plan
Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Deserialization
typo3 · typo3May 13, 2020
CVE-2025-58367
40Plan
DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Deserialization
seperman · deepdiffSep 5, 2025
CVE-2022-31106
39Monitor
Prototype Pollution in underscore.deep
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Prototype pollution
clever · underscore.deepJun 28, 2022
CVE-2024-55638
39Monitor
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
drupal · drupalDec 9, 2024
CVE-2024-55636
39Monitor
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
drupal · drupalDec 9, 2024
CVE-2024-55637
39Monitor
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
drupal · drupalDec 9, 2024
CVE-2026-9726
39Monitor
Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
alternativecommerce · alternativecommerceJul 10, 2026
CVE-2026-12535
39Monitor
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
zroger · formatter fieldJul 10, 2026
CVE-2026-54351
38Monitor
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
CriticalCVSS 9.6No exploitEPSS 0%
budibase · budibaseJun 26, 2026
CVE-2026-72710
37Monitor
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
spip · spipSep 11, 2026
CVE-2025-2304
37Monitor
Camaleon CMS Privilege Escalation
CriticalCVSS 9.4Proof of conceptEPSS 0%
owen2345 · camaleon-cmsMar 14, 2025
CVE-2026-34406
37Monitor
APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint
CriticalCVSS 9.4No exploitEPSS 0%
aptrs · aptrsMar 31, 2026
CVE-2025-24370
37Monitor
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- XSS
adamghill · django-unicornFeb 3, 2025
CVE-2024-0404
36Monitor
Mass Assignment Vulnerability in mintplex-labs/anything-llm
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mintplexlabs · anythingllmApr 15, 2024
CVE-2026-42044
36Monitor
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Prototype pollution
axios · axiosApr 24, 2026
CVE-2026-92119
36Monitor
Apache Allura: REST API Mass Assignment
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache alluraOct 12, 2026
CVE-2026-48150
36Monitor
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
CriticalCVSS 9.0No exploitEPSS 0%
budibase · budibaseMay 27, 2026
CVE-2026-34179
36Monitor
Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
CriticalCVSS 9.1No exploitEPSS 0%
canonical · lxdApr 9, 2026
CVE-2021-21368
35Monitor
msgpack5 is a msgpack v5 implementation for node.js and the browser.
HighCVSS 8.8No exploitEPSS 1%
msgpack5 project · msgpack5Mar 12, 2021

All vulnerability classes