CVE-2022-25871

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
n/a	querymen	< unspecified

References

https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488Exploit, Third Party Advisory

Timeline

Published: Jun 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258725.3All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for a CVE-2022-258735.4The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in t CVE-2022-258756.1The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of a CVE-2022-258765.5The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requ CVE-2022-258787.5The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Objec CVE-2022-25887.8It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before free CVE-2022-258809.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This CVE-2022-258817.5This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent CVE-2022-258827.5Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a p CVE-2022-258837.5Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when CVE-2022-258857.5The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is CVE-2022-258877.5The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular express