PT-2026-25713 · Lagom · Whmcs Template

S4Nnty + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4239

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lagom WHMCS Template versions through 2.3.7

Description A flaw exists within the Datatables component of Lagom WHMCS Template. This issue involves the improper control of modification of object prototype attributes, potentially allowing for remote attacks. The details of the vulnerable function are not specified. The exploit for this issue has been publicly released, and the vendor was notified but did not respond.

Recommendations Update Lagom WHMCS Template to a version beyond 2.3.7.

Exploit

Fix

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2026-4239

Affected Products

Whmcs Template

References · 7

• 🔥 https://github.com/devsamuelsantiago/lagom-prototype-pollution-poc/blob/main/lagom-prototype-pollution-poc.js · Exploit
• 🔥 https://github.com/devsamuelsantiago/lagom-prototype-pollution-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4239 · Security Note
• https://vuldb.com/?id.351181 · Note
• https://vuldb.com/?ctiid.351181 · Note
• https://vuldb.com/?submit.771350 · Note
• https://twitter.com/CVEnew/status/2033583639741796509 · Twitter Post