Vulnerabilities
Orgs hit by CVSS 9.8: Patch ThemeREX Tantra CMS to block object injection
Security teams must patch ThemeREX Tantra CMS versions up to 2.9.0 immediately to mitigate a critical deserialization vulnerability.
Object Injection
Everything Phish Herald has reported about Object Injection: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Prototype Pollution: How Object Injection Breaks Your Logic
Modifying an object’s prototype allows attackers to inject properties that every instance inherits, bypassing standard checks silently.