CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

Mongoose 代码注入漏洞

Mongoose is an Automattic open source modeling of MongoDB objects designed to work in an asynchronous environment. A code injection vulnerability exists in Mongoose versions prior to 8.9.5 that stems from incorrect use of nested filters and populate matches, resulting in search injection...

EUVD-2025-0106

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...

Code Injection

Mongoose is vulnerable to a Code Injection. The vulnerability is due to improper use of the $where operator, which allows the execution of arbitrary JavaScript code in MongoDB queries. This could lead to code injection attacks, enabling unauthorized access to or manipulation of database data...

Cesanta Mongoose Web Server <= 7.14 Multiple Vulnerabilities

Cesanta Mongoose Web Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

03-08 (=1.0.0), 06-jobs-api-vydeekelz (=1.0.0) +4046 more potentially affected by CVE-2024-53900 via mongoose (>=8.0.0 <=8.8.2)

mongoose NPM version =8.0.0, =1.0.0, =1.6.3, =1.1.2, =0.1.2, =0.1.143 - @10abdullahbutt/express-rest-api-starter =1.0.0 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

1405-authtokens (>=1.0.1 <=1.0.5), 1405_logging (=1.0.0) +3779 more potentially affected by CVE-2024-53900 via mongoose (>=3.6.11 <=5.13.22)

mongoose NPM version =3.6.11, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.17.6, =0.0.1, =1.0.16, =1.0.30, =3.7.0, =3.8.2 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

@a-la-fois/api (>=0.0.25 <=0.0.39), @a-la-fois/doc-client (>=0.0.1 <=0.0.39) +111 more potentially affected by CVE-2024-53900 via mongoose (>=7.0.0 <=7.8.2)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6, =0.2.0, =0.2.0, =0.0.0, =1.0.2, =1.0.0, =1.0.9-beta8 - @dedel.alex/adonis5-mongoose =7.6.10 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

@3kles/3kles-coremongodb (>=1.2.3 <=1.3.1), @3kles/storagebox-common (=1.0.3) +208 more potentially affected by CVE-2024-53900 via mongoose (>=6.0.1 <=6.13.4)

mongoose NPM version =6.0.1, =1.2.3, =0.0.1, =0.0.1, =0.1.0, =0.1.0, =0.0.5, =1.12.3, =0.5.0, =0.6.1 - @bonio-tw/casbin-mongoose-adapter =1.0.13-rc2 - @brontosaurus/db =3.24.0 - @brontosaurus/init =1.0.0 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

Automattic Mongoose 安全漏洞

Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 8.8.3 that stems from improper use of query operators...

EUVD-2024-3487

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

CVE-2024-53900

CVE-2024-53900 affects Mongoose. Before 8.8.3, it can improperly use $where in match, causing NoSQL injection with potential remote code execution (RCE). CVSS is 3.1 base 9.1 (CRITICAL). Mitigation: upgrade Mongoose to 8.8.3 or later; some sources describe continued risk due to incomplete fixes f...

CVE-2024-53900

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...

PT-2024-35970

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...

CVE-2024-50672

A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool = 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in...