Exploit for Code Injection in Mongoosejs Mongoose

🗓️ 11 Dec 2025 07:50:19Reported by dajneem23Type

githubexploit

githubexploit🔗 github.com👁 309 Views

PoC for command injection in Mongoose versions 7.0.0 to 14; run server and exploit against local MongoDB.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Mongoose	6 May 202519:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Mongoose	15 Apr 202503:57	–	ibm
IBM Security Bulletins	Security Bulletin: Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.	17 Apr 202503:08	–	ibm
IBM Security Bulletins	Security Bulletin: Mongoose Improper Handling of Nested $where in populate() Match Allows Search Injection	26 Jun 202518:27	–	ibm
GithubExploit	Exploit for CVE-2024-53900	3 Apr 202517:01	–	githubexploit
GithubExploit	Exploit for CVE-2024-53900	19 Aug 202510:20	–	githubexploit
BDU FSTEC	The vulnerability of the Mongoose library, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary code and gain access to read and modify data.	24 Feb 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the populate() function in the Mongoose library allows a hacker to execute arbitrary code and gain access to read and modify data.	24 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-53900	2 Dec 202422:06	–	circl
Circl	CVE-2025-23061	15 Jan 202504:32	–	circl

11 Dec 2025 07:59Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.1 - 9.8

EPSS0.71855

SSVC

command injection mongoose versions local mongodb proof of concept cve 2025 23061