joi: joi: Prototype Pollution via custom messages

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

joi: joi: Prototype Pollution via custom messages

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

NPM: joi: Prototype pollution via a `__proto__` language key in custom messages

NPM: joi: Prototype pollution via a proto language key in custom messages vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.6...

joi: Prototype pollution via a `__proto__` language key in custom messages

Impact An application that passes attacker-controlled data into joi's custom message configuration messages, message, prefs messages , Joi.extend messages or rule message lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named...

GHSA-6W3J-5FW6-R9VR joi: Prototype pollution via a `__proto__` language key in custom messages

Impact An application that passes attacker-controlled data into joi's custom message configuration messages, message, prefs messages , Joi.extend messages or rule message lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named...

CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

EUVD-2015-9157

Malware in sbrugna...

CVE-2025-24660

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through = 2.4...

CVE-2025-24660

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through = 2.4...

CVE-2025-24660: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through = 2.4...

PT-2025-5481 · Unknown · Simple Membership Custom Messages

Name of the Vulnerable Software and Affected Versions: Simple Membership Custom Messages versions through 2.4 Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into...

WordPress Simple Membership Custom Messages Plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Simple Membership Custom Messages versions = 2.4...

CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then...

FormCraft < 1.2.7 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. There are two XSS issues: Example A: ...

Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

GHSA-V9XQ-VH72-CHR4 Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...