CVE-2026-4239

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-94 CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-423905.3An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.CVE-2026-423917.5An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP CVE-2026-423924.3An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the er CVE-2026-423933.1The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An att CVE-2026-423954.3A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following log CVE-2026-423966.5Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail CVE-2026-423976.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-423987.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-confi CVE-2026-423996.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated l CVE-2026-42407.5A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s CVE-2026-424006.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u CVE-2026-424015.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access t