CVE-2025-23061-LAB

لا يحتوي هذا المستودع على ملف README...

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

Exploit for Code Injection in Mongoosejs Mongoose

CVE-2025-23061 - Mongoose Command Injection A proof of concep...

Security Bulletin: Mongoose Improper Handling of Nested $where in populate() Match Allows Search Injection

Summary Mongoose improper handling of nested $where in populate match allows search injection due to incomplete fix for CVE-2024-53900. Vulnerability Details CVEID:CVE-2025-23061 DESCRIPTION: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Mongoose

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Mongoose Vulnerability Details CVEID:CVE-2025-23061 DESCRIPTION: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an...

4casterschemas (>=1.0.0, <=1.0.1), @3kles/3kles-coremongodb (>=2.1.5, <=2.1.6) +113 more potentially affected by CVE-2025-23061 via mongoose (>=8.0.0, <=8.9.4)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =1.1.9, =2.0.0, =2.0.7 and more Source cves: CVE-2025-23061 Source advisory: OSV:GHSA-VG7J-7CWX-8WGW...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +111 more potentially affected by CVE-2025-23061 via mongoose (>=7.0.0, <=7.8.3)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.3 and more Source cves: CVE-2025-23061 Source advisory: OSV:GHSA-VG7J-7CWX-8WGW...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +414 more potentially affected by CVE-2025-23061 via mongoose (>=6.0.1, <=6.13.5)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: CVE-2025-23061 Source advisory: OSV:GHSA-VG7J-7CWX-8WGW...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

CVE-2025-23061

CVE-2025-23061 affects Mongoose before 8.9.5, enabling search injection via a nested $where filter in populate() match. This builds on an incomplete fix for CVE-2024-53900, as evidenced by multiple connected documents (Nuclei template, IBM security bulletins, and IBM/CVE details) describing NoSQL...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...