CVE-2024-53900

es-define-property Object.defineProperty, but not IE 8's broken one...

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

CVE-2025-23061

CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...

CVE-2025-51495

Me gustaría informar sobre una vulnerabilidad de seguridad identificada en la última versión de Mongoose v7.17. El problema reside en el módulo WebSocket, específicamente dentro de la función mgwscb encargada de manejar los frames WebSocket entrantes. La función es vulnerable a un desbordamiento ...

0xsp-Mongoose

Support the project for continuous development ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 0xsp Mongoose RED for Windows Current Release 2.2.0 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted...

CVE-2024-53900

Desafío CTF - Mongoose RCE CVE-2024-53900 Resumen del Desafío Este desafío de Captura la Bandera CTF está basado en CVE-2024-53900, una vulnerabilidad en Mongoose que permite la Ejecución Remota de Código RCE debido al uso incorrecto del operador $where en consultas MongoDB. ¡Tu objetivo es...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Aviso de seguridad: la búsqueda de sala sin verificar provoca la caída del servidor Let's Chat ID de CVE asignado: CVE-2026-66749 Resumen Una única solicitud HTTP desde cualquier cuenta iniciada detiene el proceso del servidor de Let's Chat. GET /messages toma un parámetro room, busca esa sala po...

Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

react-mongoose (>=1.0.0, <=1.0.5) potentially affected by unknown CVE via express-mongo-limit (1.0.4)

express-mongo-limit NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on express-mongo-limit and may be impacted: - react-mongoose =1.0.0, =1.0.5 Source cves: unknown CVE Source advisory: SNYK:JS-EXPRESSMONGOLIMIT-19477334...

MAL-2026-15845 Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ROOT-APP-NPM-CVE-2025-23061 CVE-2025-23061 in mongoose - Patched by Root

Root has patched CVE-2025-23061 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-3696 CVE-2023-3696 in mongoose - Patched by Root

Root has patched CVE-2023-3696 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42334 CVE-2026-42334 in mongoose - Patched by Root

Root has patched CVE-2026-42334 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-53900 CVE-2024-53900 in mongoose - Patched by Root

Root has patched CVE-2024-53900 in the mongoose package for Root:npm. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...