Common Weakness Enumeration

CWE-915

Allowed

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

280 vulnerabilities reference this CWE, most recent first.

GHSA-X3C7-22C8-PRG7

Vulnerability from github – Published: 2025-06-13 21:09 – Updated: 2025-06-14 00:23
VLAI
Summary
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution
Details

Impact

goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with Version 1.4.3

Workarounds

Patch src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php:

+    public function __wakeup() {
+       throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__);
+    }

However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.

References

Are there any links users can visit to find out more?

Severity
3.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "handcraftedinthealps/goodby-csv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-13T21:09:00Z",
    "nvd_published_at": "2025-06-13T20:15:23Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\ngoodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called \"gadget chain\" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.\n\n### Patches\n\nHas the problem been patched? What versions should users upgrade to?\n\nThe problem is patched with Version 1.4.3\n\n### Workarounds\n\nPatch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`:\n\n```diff\n+    public function __wakeup() {\n+       throw new \\BadMethodCallException(\u0027Cannot unserialize \u0027 . __CLASS__);\n+    }\n```\n\nHowever, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-x3c7-22c8-prg7",
  "modified": "2025-06-14T00:23:21Z",
  "published": "2025-06-13T21:09:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49597"
    },
    {
      "type": "WEB",
      "url": "https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/handcraftedinthealps/goodby-csv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution"
}

GHSA-X3WR-V4WX-5QPC

Vulnerability from github – Published: 2021-06-21 17:14 – Updated: 2022-06-29 20:41
VLAI
Summary
Prototype Pollution
Details

Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "expand-hash"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-25948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-14T19:29:17Z",
    "nvd_published_at": "2021-06-10T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in \u2018expand-hash\u2019 versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.",
  "id": "GHSA-x3wr-v4wx-5qpc",
  "modified": "2022-06-29T20:41:54Z",
  "published": "2021-06-21T17:14:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25948"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/doowb/expand-hash"
    },
    {
      "type": "WEB",
      "url": "https://github.com/doowb/expand-hash/blob/556913f6c2f05848110b5b8261cfc78e5ce3dc77/index.js#L19"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25948"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution"
}

GHSA-X5M4-G2CQ-52PQ

Vulnerability from github – Published: 2026-07-02 20:03 – Updated: 2026-07-02 20:03
VLAI
Summary
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Details

Summary

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

Details

ElementsController::beforeAction() (src/controllers/ElementsController.php:119-124) pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level:

$this->_attributes = $this->request->getBodyParams();

// No funny business
if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) {
    throw new BadRequestHttpException('Changing an element’s ID is not allowed.');
}

The check inspects only the top-level payload. actionBulkDuplicate() (src/controllers/ElementsController.php:1708-1749) reads a separate newAttributes array and passes it straight through to the service layer:

$elementInfo = $this->request->getRequiredBodyParam('elements');
$newAttributes = $this->request->getRequiredBodyParam('newAttributes');
...
$safeNewAttributes = Collection::make($newAttributes)
    ->only($element->safeAttributes())
    ->all();
...
$newElement = $elementsService->duplicateElement(
    $element,
    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),
    false,
    checkAuthorization: true,
);

Elements::duplicateElement() (src/services/Elements.php:1814-1840) clones the source element, sets id to null, and then hands the attacker's array to Craft::configure():

$mainClone = clone $element;
$mainClone->id = null;
$mainClone->uid = StringHelper::UUID();
...
Craft::configure($mainClone, ArrayHelper::merge(
    $newAttributes,
    $siteAttributes[$mainClone->siteId] ?? [],
));

Craft::configure() overwrites the reset id with any numeric value inside $newAttributes. Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.

safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it.

Impact

A low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.7.0"
            },
            {
              "fixed": "5.9.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T20:03:36Z",
    "nvd_published_at": "2026-07-02T17:17:00Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThere is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary `id` through the `newAttributes` request parameter. The duplication routine overrides its own `id = null` reset with that value and writes Alice\u2019s attributes into Bob\u2019s existing entry row.\n\n## Details\n\n`ElementsController::beforeAction()` (`src/controllers/ElementsController.php:119-124`) pulls the request body into `$this-\u003e_attributes` and rejects requests that ship an `id` or `canonicalId` key at the top level:\n\n```php\n$this-\u003e_attributes = $this-\u003erequest-\u003egetBodyParams();\n\n// No funny business\nif (isset($this-\u003e_attributes[\u0027id\u0027]) || isset($this-\u003e_attributes[\u0027canonicalId\u0027])) {\n    throw new BadRequestHttpException(\u0027Changing an element\u2019s ID is not allowed.\u0027);\n}\n```\n\nThe check inspects only the top-level payload. `actionBulkDuplicate()` (`src/controllers/ElementsController.php:1708-1749`) reads a separate `newAttributes` array and passes it straight through to the service layer:\n\n```php\n$elementInfo = $this-\u003erequest-\u003egetRequiredBodyParam(\u0027elements\u0027);\n$newAttributes = $this-\u003erequest-\u003egetRequiredBodyParam(\u0027newAttributes\u0027);\n...\n$safeNewAttributes = Collection::make($newAttributes)\n    -\u003eonly($element-\u003esafeAttributes())\n    -\u003eall();\n...\n$newElement = $elementsService-\u003eduplicateElement(\n    $element,\n    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),\n    false,\n    checkAuthorization: true,\n);\n```\n\n`Elements::duplicateElement()` (`src/services/Elements.php:1814-1840`) clones the source element, sets `id` to null, and then hands the attacker\u0027s array to `Craft::configure()`:\n\n```php\n$mainClone = clone $element;\n$mainClone-\u003eid = null;\n$mainClone-\u003euid = StringHelper::UUID();\n...\nCraft::configure($mainClone, ArrayHelper::merge(\n    $newAttributes,\n    $siteAttributes[$mainClone-\u003esiteId] ?? [],\n));\n```\n\n`Craft::configure()` overwrites the reset `id` with any numeric value inside `$newAttributes`. Yii\u0027s `saveElement()` then performs an UPDATE against the row with that primary key instead of an INSERT. Alice\u0027s title, slug, authorId, postDate, and UID land on Bob\u2019s entry.\n\n`safeAttributes()` on `Entry` includes `id` because the base element model exposes it, so the `Collection::only()` filter does not strip it.\n\n## Impact\n\nA low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.",
  "id": "GHSA-x5m4-g2cq-52pq",
  "modified": "2026-07-02T20:03:36Z",
  "published": "2026-07-02T20:03:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-x5m4-g2cq-52pq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/8f6587c25050bbb6e080d59c71f6bb8932fc8600"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS\u0027s mass assignment via id in newAttributes during bulk duplicate overwrites existing elements"
}

GHSA-X5V6-PJ28-CWWM

Vulnerability from github – Published: 2026-05-14 14:52 – Updated: 2026-06-09 13:09
VLAI
Summary
FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
Details

Summary

A Mass Assignment vulnerability exists in the tool update endpoint of FlowiseAI.

The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource.

Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.

Details

The endpoint responsible for updating tools:

PUT /api/v1/tools/{toolId}

accepts a JSON request body containing tool metadata.

However, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.

Server-controlled fields that can be manipulated include:

  1. workspaceId
  2. createdDate
  3. updatedDate

The request body is directly merged into the underlying database entity without proper DTO validation or authorization checks.

PoC

Authenticate to the Flowise interface.

Capture the request used to update a tool:

PUT /api/v1/tools/<TOOL_ID>
Content-Type: application/json

Modify the request body by injecting additional fields:

{
  "name": "aaa",
  "description": "bbb",
  "color": "linear-gradient(rgb(109,215,45), rgb(136,170,134))",
  "schema": "[]",
  "func": "",
  "iconSrc": "test",
  "workspaceId": "11111111-2222-3333-4444-555555555555",
  "createdDate": "1995-03-06T14:17:50.000Z",
  "updatedDate": "1995-03-06T14:17:50.000Z"
}

Send the request.

Observe that the response includes the manipulated fields:

{
  "workspaceId": "11111111-2222-3333-4444-555555555555",
  "createdDate": "1995-03-06T14:17:50.000Z"
}

This confirms that client-controlled values are accepted and persisted by the server.

Impact

This vulnerability allows authenticated users to manipulate internal attributes of tool resources.

Confirmed impacts include:

  • Cross-workspace reassignment of tools (workspaceId)
  • Unauthorized modification of metadata (createdDate, updatedDate)

In multi-tenant deployments, this may allow an attacker to move tools between workspaces without authorization, breaking tenant isolation boundaries.

Severity
7.6 (High)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42862"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T14:52:40Z",
    "nvd_published_at": "2026-06-08T16:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Mass Assignment vulnerability exists in the tool update endpoint of FlowiseAI.\n\nThe endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource.\n\nDue to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments.\n\n### Details\nThe endpoint responsible for updating tools:\n\n**PUT /api/v1/tools/{toolId}**\n\naccepts a JSON request body containing tool metadata.\n\nHowever, the server does not restrict which properties may be modified by the client. As a result, user-controlled request bodies can include additional fields that should normally be controlled only by the backend.\n\nServer-controlled fields that can be manipulated include:\n\n1. workspaceId\n2. createdDate\n3. updatedDate\n\nThe request body is directly merged into the underlying database entity without proper DTO validation or authorization checks.\n\n### PoC\nAuthenticate to the Flowise interface.\n\nCapture the request used to update a tool:\n\n```http\nPUT /api/v1/tools/\u003cTOOL_ID\u003e\nContent-Type: application/json\n\nModify the request body by injecting additional fields:\n\n{\n  \"name\": \"aaa\",\n  \"description\": \"bbb\",\n  \"color\": \"linear-gradient(rgb(109,215,45), rgb(136,170,134))\",\n  \"schema\": \"[]\",\n  \"func\": \"\",\n  \"iconSrc\": \"test\",\n  \"workspaceId\": \"11111111-2222-3333-4444-555555555555\",\n  \"createdDate\": \"1995-03-06T14:17:50.000Z\",\n  \"updatedDate\": \"1995-03-06T14:17:50.000Z\"\n}\n\n```\nSend the request.\n\nObserve that the response includes the manipulated fields:\n\n```json\n{\n  \"workspaceId\": \"11111111-2222-3333-4444-555555555555\",\n  \"createdDate\": \"1995-03-06T14:17:50.000Z\"\n}\n```\n\nThis confirms that client-controlled values are accepted and persisted by the server.\n\n### Impact\nThis vulnerability allows authenticated users to manipulate internal attributes of tool resources.\n\nConfirmed impacts include:\n\n- Cross-workspace reassignment of tools (workspaceId)\n- Unauthorized modification of metadata (createdDate, updatedDate)\n\nIn multi-tenant deployments, this may allow an attacker to move tools between workspaces without authorization, breaking tenant isolation boundaries.",
  "id": "GHSA-x5v6-pj28-cwwm",
  "modified": "2026-06-09T13:09:57Z",
  "published": "2026-05-14T14:52:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x5v6-pj28-cwwm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42862"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment"
}

GHSA-X5VH-96V7-W3PH

Vulnerability from github – Published: 2026-05-13 21:32 – Updated: 2026-05-13 21:32
VLAI
Details

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-45229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-13T21:16:49Z",
    "severity": "HIGH"
  },
  "details": "Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.",
  "id": "GHSA-x5vh-96v7-w3ph",
  "modified": "2026-05-13T21:32:07Z",
  "published": "2026-05-13T21:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45229"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cp0204/quark-auto-save/commit/ea8377a596446291953dbe36e2d119d85bcd865b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cp0204/quark-auto-save/releases/tag/v0.8.5"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/quark-drive-mass-assignment-via-post-update"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-X6C6-VG4W-8R3R

Vulnerability from github – Published: 2026-06-25 18:30 – Updated: 2026-06-25 21:31
VLAI
Details

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plg_user_k2. A Registered Joomla user, by including the field K2UserForm=1 in a standard com_users profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the #__k2_users table — none of which are exposed by the K2 frontend profile-edit form.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-48943"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T16:16:36Z",
    "severity": "MODERATE"
  },
  "details": "K2 \u2264 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table \u2014 none of which are exposed by the K2 frontend profile-edit form.",
  "id": "GHSA-x6c6-vg4w-8r3r",
  "modified": "2026-06-25T21:31:29Z",
  "published": "2026-06-25T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48943"
    },
    {
      "type": "WEB",
      "url": "https://www.getk2.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X7HC-R9M3-67VR

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-13 21:31
VLAI
Details

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1..

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-55804"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T22:16:43Z",
    "severity": "MODERATE"
  },
  "details": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.",
  "id": "GHSA-x7hc-r9m3-67vr",
  "modified": "2026-07-13T21:31:18Z",
  "published": "2026-07-11T00:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55804"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2026-006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XMJC-63PR-2MPG

Vulnerability from github – Published: 2026-05-20 00:31 – Updated: 2026-06-05 18:18
VLAI
Summary
Drupal core allows Object Injection
Details

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "10.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.6.0"
            },
            {
              "fixed": "10.6.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.3.0"
            },
            {
              "fixed": "11.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-6366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T18:18:11Z",
    "nvd_published_at": "2026-05-19T23:16:58Z",
    "severity": "MODERATE"
  },
  "details": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.\n\nThis issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.",
  "id": "GHSA-xmjc-63pr-2mpg",
  "modified": "2026-06-05T18:18:11Z",
  "published": "2026-05-20T00:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6366"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/drupal/core"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2026-002"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Drupal core allows Object Injection"
}

GHSA-XP9C-82X8-7F67

Vulnerability from github – Published: 2021-02-26 16:31 – Updated: 2021-09-22 13:55
VLAI
Summary
Prototype Pollution in Node-Red
Details

Impact

Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime.

Patches

The vulnerability is patched in the 1.2.8 release.

Workarounds

A workaround is to ensure only authorised users are able to access the editor url.

For more information

If you have any questions or comments about this advisory: * Email us at team@nodered.org

Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@node-red/runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21297"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-02-26T16:22:38Z",
    "nvd_published_at": "2021-02-26T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nNode-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime.\n\n### Patches\n\nThe vulnerability is patched in the 1.2.8 release.\n\n### Workarounds\n\nA workaround is to ensure only authorised users are able to access the editor url.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@nodered.org](mailto:team@nodered.org)\n\n### Acknowledgements\n\nThanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.",
  "id": "GHSA-xp9c-82x8-7f67",
  "modified": "2021-09-22T13:55:00Z",
  "published": "2021-02-26T16:31:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21297"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/node-red/node-red"
    },
    {
      "type": "WEB",
      "url": "https://github.com/node-red/node-red/releases/tag/1.2.8"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@node-red/editor-api"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@node-red/runtime"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in Node-Red"
}

GHSA-XVR9-JR9P-GRF3

Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2026-07-05 00:31
VLAI
Details

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-24036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-915"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-04T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.",
  "id": "GHSA-xvr9-jr9p-grf3",
  "modified": "2026-07-05T00:31:17Z",
  "published": "2022-05-24T17:43:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24036"
    },
    {
      "type": "WEB",
      "url": "https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036"
    },
    {
      "type": "WEB",
      "url": "https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04"
    },
    {
      "type": "WEB",
      "url": "http://forkcms.com"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/161764/ForkCMS-PHP-Object-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2021/Mar/31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation
  • If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
  • For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Mitigation
Architecture and Design Implementation

If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

Mitigation
Implementation

Strategy: Input Validation

For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

Mitigation
Implementation Architecture and Design

Strategy: Refactoring

Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list