PT-2026-58064

CVE-2026-15698

Published

2026-07-14

Updated

2026-09-24

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kofrasa mingo versions prior to 7.2.2

Description An issue exists in the Update API component where manipulating the Set argument within the update(), updateOne(), and updateMany() functions can lead to improperly controlled modification of object prototype attributes. This condition allows for a remote attack.

Recommendations Upgrade to version 7.2.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers