CVE-2026-4239
Prototype Pollution in Lagom WHMCS Datatables Enables Remote Attack
Publication date: 2026-03-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| datatables | datatables | to 1.10.23 (exc) |
| lagom | whmcs_template | to 2.3.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Lagom WHMCS Template up to version 2.3.7, specifically in an unknown function of the Datatables component. It allows an attacker to manipulate and improperly control the modification of object prototype attributes. This manipulation can be performed remotely, and the exploit has been made public.
How can this vulnerability impact me? :
The vulnerability enables remote attackers to modify object prototype attributes in an uncontrolled manner. This can lead to unexpected behavior in the affected application, potentially allowing attackers to influence the application's logic or cause it to behave incorrectly. However, the impact is limited as the CVSS scores indicate low to moderate severity, with no direct impact on confidentiality or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know