cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection

cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1...

kimi

Kimi: Attack Surface Discovery Engine Developed with 💜 by @alechilczenko Project Context: This project serves as a portfolio piece demonstrating concepts in offensive security, concurrency, and distributed architecture. 1. Introducing Kimi: The Origin Story What was Kimi ? During my early days...

CVE-2025-14847

🍃 CVE-2025-14847 — MongoBleed 🍃 MongoBleed — MongoDB Server Memory Disclosure Vulnerability 🍃 Overview CVE-2025-14847, known as MongoBleed , is a security vulnerability affecting MongoDB Server's handling of compressed network messages. Under vulnerable conditions, an unauthenticated remote...

CVE-2025-14847

CVE-2025-14847 Description CVE-2025–14847, also known as MongoBleed, is a vulnerability that allows attackers to perform unauthorized data reads from the heap memory space of the server on which the MongoDB database runs, without authentication. How to Reproduce podman-compose vuln-machine/ up -d...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit...

Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

MongoBleed-CVE-2025-14847-Fully-Automated-scanner

This repository does not have a README...

CVE_2020_35848

🧨 CVE‑2020‑35848 – Cockpit CMS 0.11.2 NoSQL Injection RCE Lab CVE‑2020‑35848 affects Agentejo Cockpit CMS versions before 0.11.2, introducing a critical NoSQL injection vulnerability in the /auth/newpassword endpoint. This flaw allows unauthenticated attackers to inject MongoDB operators into...

ipChecker

ipChecker Tool to check if a given IP is a node tor or an open proxy. Why? Sometimes all your throttles are not enough to stop brute force attacks or any kind of massive attacks, so it can help you to drop, some attackers who use tor or open proxies. How it works The ipChecker has some plugins...

MongoBLEED---CVE-2025-14847-POC-

MongoBLEED---CVE-2025-14847-POC- This repo contains my python script version of CVE-2025-14847 MongoBleed Description The script simulates a malicious request by sending a forged decompression size field. If the server is vulnerable, it will return adjacent data from the heap memory. Prerequisite...

CVE-2025-14847

CVE-2025-14847 MongoBleed 📜 Description This script is designed to exploit the heap memory disclosure vulnerability known as CVE-2025-14847 "MongoBleed" in MongoDB Server. By sending specially crafted zlib-compressed OPMSG packets with an inflated document length, the script tricks the server int...

mongobleed

MongoDB Compression Leak Lab Safe, Educational Reference CVE : CVE-2025-14847 This repository is an educational lab that demonstrates the concept behind a class of issues often described as “compression framing / size-metadata memory disclosure” in database wire protocols. It is written to suppor...

mongoBuster

mongoBuster Hunt Open MongoDB instances! Features Worlds fastest and most efficient scanner Uses Masscan . Scans entire internet by default, So fire the tool and chill. Hyper efficient - Uses Go-routines which are even lighter than threads. Pre-Requisites - Go language sudo apt install golang...

CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit is a Proof-of-Concept PoC exploit tool for CVE-2025-14847 , a memory leak vulnerability in MongoDB. This tool exploits a bug in zlib decompression to leak server memory via BSON field names. By crafting a BSON payload with an inflated document length, it...

cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666 Accept-Encodin...

CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Detect exposed MongoDB instances and CVE-2025-14847 "MongoBleed" risks — Zero-Trust Python scanner. In 2026, misconfigured MongoDB databases remain one of the top causes of data breaches and ransomware attacks. This tool helps defenders identify open...

cve-search

cve-search cve-search is a tool to import CVE Common Vulnerabilities and Exposures and CPE Common Platform Enumeration into a MongoDB to facilitate search and processing of CVEs. The main objective of the software is to avoid doing direct and public lookups into the public CVE databases. Local...

CVE-2025-14857-MongoBleed

CVE-2025-14847 MongoBleed - Functional PoC MongoDB Memory Leak Exploitation - Simulated R6 Attack Complete Proof of Concept for CVE-2025-14847 MongoBleed Tested: ✅ MongoDB 7.0.5 | 14,300+ Successful Exploits | 4 Leaked UUIDs 🎯 About the Project This repository contains a fully functional Proof of...

CVE-2025-61777

CVE-2025-61777 1. Unauthorized modification of badge templates on FlagforgeCTF CVE-2025-61777 Summary The Flagforge application https://flagforge.xyz exposes critical vulnerabilities in its administrative API endpoints, specifically /api/admin/badge-templates GET and...