CWE-915 · 111 kayıt

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Bu sınıftaki CVE’ler

111 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
47Planlayın	CVE-2024-5452Kavram kanıtı	RCE via Property/Class Pollution in lightning-ai/pytorch-lightninglightningai · pytorch lightning · CWE-915 pre-auth RCE Deserializasyon	Kritik9,8	—	%26,8	6 Haz 2024
42Planlayın	CVE-2026-33453Kavram kanıtı	Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Executionapache · camel · CWE-915 pre-auth RCE	Kritik10,0	—	%7,2	27 Nis 2026
41Planlayın	CVE-2026-50160Kavram kanıtı	Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwritehoppscotch · hoppscotch · CWE-915 Kimlik doğrulamasız	Kritik10,0	—	%1,7	1 Tem 2026
40Planlayın	CVE-2022-43441İstismar yok	A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.ghost · sqlite3 · CWE-915 pre-auth RCE	Kritik9,8	—	%2,4	16 Mar 2023
40Planlayın	CVE-2021-21304İstismar yok	Prototype Pollution in Dynamoosedynamoosejs · dynamoose · CWE-915 Kimlik doğrulamasız Prototype pollution	Kritik9,8	—	%1,9	8 Şub 2021
40Planlayın	CVE-2022-24802İstismar yok	Prototype Pollution in deepmerge-tsdeepmerge-ts project · deepmerge-ts · CWE-915 Kimlik doğrulamasız Prototype pollution	Kritik9,8	—	%1,7	31 Mar 2022
40Planlayın	CVE-2020-11066İstismar yok	Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMStypo3 · typo3 · CWE-915 Kimlik doğrulamasız Deserializasyon	Kritik10,0	—	%1,5	13 May 2020
40Planlayın	CVE-2025-58367İstismar yok	DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionseperman · deepdiff · CWE-915 pre-auth RCE Deserializasyon	Kritik10,0	—	%1,1	5 Eyl 2025
39İzleyin	CVE-2022-31106İstismar yok	Prototype Pollution in underscore.deepclever · underscore.deep · CWE-915 Kimlik doğrulamasız Prototype pollution	Kritik9,8	—	%1,1	28 Haz 2022
39İzleyin	CVE-2024-55638İstismar yok	Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008drupal · drupal · CWE-915 pre-auth RCE Deserializasyon	Kritik9,8	—	%1,0	9 Ara 2024
39İzleyin	CVE-2024-55636İstismar yok	Drupal core - Less critical - Gadget chain - SA-CORE-2024-006drupal · drupal · CWE-915 pre-auth RCE Deserializasyon	Kritik9,8	—	%0,9	9 Ara 2024
39İzleyin	CVE-2024-55637İstismar yok	Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007drupal · drupal · CWE-915 pre-auth RCE Deserializasyon	Kritik9,8	—	%0,8	9 Ara 2024
39İzleyin	CVE-2026-12535İstismar yok	Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048zroger · formatter field · CWE-915 Kimlik doğrulamasız	Kritik9,8	—	%0,6	10 Tem 2026
39İzleyin	CVE-2026-9726İstismar yok	Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038alternativecommerce · alternativecommerce · CWE-915 Kimlik doğrulamasız	Kritik9,8	—	%0,6	10 Tem 2026
38İzleyin	CVE-2026-54351İstismar yok	Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Overridebudibase · budibase · CWE-915	Kritik9,6	—	%0,5	26 Haz 2026
37İzleyin	CVE-2026-72710İstismar yok	SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injectionspip · spip · CWE-915 pre-auth RCE	Kritik9,3	—	%1,1	11 Eyl 2026
37İzleyin	CVE-2026-34406İstismar yok	APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpointaptrs · aptrs · CWE-915	Kritik9,4	—	%0,8	31 Mar 2026
37İzleyin	CVE-2025-2304Kavram kanıtı	Camaleon CMS Privilege Escalationowen2345 · camaleon-cms · CWE-915	Kritik9,4	—	%0,6	14 Mar 2025
37İzleyin	CVE-2025-24370İstismar yok	Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypassadamghill · django-unicorn · CWE-915 Kimlik doğrulamasız Kimlik doğrulama atlatma XSS	Kritik9,3	—	%0,5	3 Şub 2025
36İzleyin	CVE-2026-42044İstismar yok	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`axios · axios · CWE-915 Kimlik doğrulamasız Prototype pollution	Kritik9,1	—	%0,9	24 Nis 2026
36İzleyin	CVE-2024-0404İstismar yok	Mass Assignment Vulnerability in mintplex-labs/anything-llmmintplexlabs · anythingllm · CWE-915 Kimlik doğrulamasız	Kritik9,1	—	%0,8	15 Nis 2024
36İzleyin	CVE-2026-48150İstismar yok	Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignbudibase · budibase · CWE-915	Kritik9,0	—	%0,5	27 May 2026
36İzleyin	CVE-2026-34179İstismar yok	Update of type field in restricted TLS certificate allows privilege escalation to cluster admincanonical · lxd · CWE-915	Kritik9,1	—	%0,4	9 Nis 2026
35İzleyin	CVE-2021-21368İstismar yok	msgpack5 is a msgpack v5 implementation for node.js and the browser.msgpack5 project · msgpack5 · CWE-915	Yüksek8,8	—	%1,6	12 Mar 2021
35İzleyin	CVE-2023-32079İstismar yok	Netmaker Privilige Escalation Vulnerabilitynetmaker · netmaker · CWE-915	Yüksek8,8	—	%0,9	24 Ağu 2023

CVE-2024-5452
47Planlayın
RCE via Property/Class Pollution in lightning-ai/pytorch-lightning
KritikCVSS 9,8Kavram kanıtıEPSS %27
- pre-auth RCE
- Deserializasyon
lightningai · pytorch lightning6 Haz 2024
CVE-2026-33453
42Planlayın
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
KritikCVSS 10,0Kavram kanıtıEPSS %7
- pre-auth RCE
apache · camel27 Nis 2026
CVE-2026-50160
41Planlayın
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
KritikCVSS 10,0Kavram kanıtıEPSS %2
- Kimlik doğrulamasız
hoppscotch · hoppscotch1 Tem 2026
CVE-2022-43441
40Planlayın
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.
KritikCVSS 9,8İstismar yokEPSS %2
- pre-auth RCE
ghost · sqlite316 Mar 2023
CVE-2021-21304
40Planlayın
Prototype Pollution in Dynamoose
KritikCVSS 9,8İstismar yokEPSS %2
- Kimlik doğrulamasız
- Prototype pollution
dynamoosejs · dynamoose8 Şub 2021
CVE-2022-24802
40Planlayın
Prototype Pollution in deepmerge-ts
KritikCVSS 9,8İstismar yokEPSS %2
- Kimlik doğrulamasız
- Prototype pollution
deepmerge-ts project · deepmerge-ts31 Mar 2022
CVE-2020-11066
40Planlayın
Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS
KritikCVSS 10,0İstismar yokEPSS %2
- Kimlik doğrulamasız
- Deserializasyon
typo3 · typo313 May 2020
CVE-2025-58367
40Planlayın
DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution
KritikCVSS 10,0İstismar yokEPSS %1
- pre-auth RCE
- Deserializasyon
seperman · deepdiff5 Eyl 2025
CVE-2022-31106
39İzleyin
Prototype Pollution in underscore.deep
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
- Prototype pollution
clever · underscore.deep28 Haz 2022
CVE-2024-55638
39İzleyin
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
KritikCVSS 9,8İstismar yokEPSS %1
- pre-auth RCE
- Deserializasyon
drupal · drupal9 Ara 2024
CVE-2024-55636
39İzleyin
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
KritikCVSS 9,8İstismar yokEPSS %1
- pre-auth RCE
- Deserializasyon
drupal · drupal9 Ara 2024
CVE-2024-55637
39İzleyin
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
KritikCVSS 9,8İstismar yokEPSS %1
- pre-auth RCE
- Deserializasyon
drupal · drupal9 Ara 2024
CVE-2026-12535
39İzleyin
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
zroger · formatter field10 Tem 2026
CVE-2026-9726
39İzleyin
Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
KritikCVSS 9,8İstismar yokEPSS %1
- Kimlik doğrulamasız
alternativecommerce · alternativecommerce10 Tem 2026
CVE-2026-54351
38İzleyin
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
KritikCVSS 9,6İstismar yokEPSS %0
budibase · budibase26 Haz 2026
CVE-2026-72710
37İzleyin
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
KritikCVSS 9,3İstismar yokEPSS %1
- pre-auth RCE
spip · spip11 Eyl 2026
CVE-2026-34406
37İzleyin
APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint
KritikCVSS 9,4İstismar yokEPSS %1
aptrs · aptrs31 Mar 2026
CVE-2025-2304
37İzleyin
Camaleon CMS Privilege Escalation
KritikCVSS 9,4Kavram kanıtıEPSS %1
owen2345 · camaleon-cms14 Mar 2025
CVE-2025-24370
37İzleyin
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- XSS
adamghill · django-unicorn3 Şub 2025
CVE-2026-42044
36İzleyin
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
KritikCVSS 9,1İstismar yokEPSS %1
- Kimlik doğrulamasız
- Prototype pollution
axios · axios24 Nis 2026
CVE-2024-0404
36İzleyin
Mass Assignment Vulnerability in mintplex-labs/anything-llm
KritikCVSS 9,1İstismar yokEPSS %1
- Kimlik doğrulamasız
mintplexlabs · anythingllm15 Nis 2024
CVE-2026-48150
36İzleyin
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
KritikCVSS 9,0İstismar yokEPSS %0
budibase · budibase27 May 2026
CVE-2026-34179
36İzleyin
Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
KritikCVSS 9,1İstismar yokEPSS %0
canonical · lxd9 Nis 2026
CVE-2021-21368
35İzleyin
msgpack5 is a msgpack v5 implementation for node.js and the browser.
YüksekCVSS 8,8İstismar yokEPSS %2
msgpack5 project · msgpack512 Mar 2021
CVE-2023-32079
35İzleyin
Netmaker Privilige Escalation Vulnerability
YüksekCVSS 8,8İstismar yokEPSS %1
netmaker · netmaker24 Ağu 2023

Tüm zafiyet sınıfları