1786 matches found
Mongoose - NoSQL Injection
NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...
Mongoose < 8.8.3 - Remote Code Execution
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...
0xsp-Mongoose
Support the project for continuous development ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 0xsp Mongoose RED for Windows Current Release 2.2.0 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted...
CVE-2026-125120
A flaw was found in Mongoose. The countDocuments function fails to apply the configured sanitizeFilter defense against query selector injection. A remote attacker could exploit this flaw by passing crafted filter queries containing database operator objects instead of literal values. Consequently...
CVE-2024-53900
CTF Challenge - Mongoose RCE CVE-2024-53900 Challenge Overview This Capture The Flag CTF challenge is based on CVE-2024-53900, a vulnerability in Mongoose that allows Remote Code Execution RCE due to improper use of the $where operator in MongoDB queries. Your objective is to exploit this...
CLSA-2026-1794439793 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.40.0-tuxcare.3...
CLSA-2026-1794439665 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.33.4-tuxcare.1...
CVE-2025-23061
CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...
CLSA-2026-1794390937 TuxCare security update for mongoose (2 CVEs)
TuxCare rebuilt mongoose to address 2 CVEs. Fixed in 6.12.2-tuxcare.6...
CVE-2026-125117
A flaw was found in mongoose. When processing untrusted database documents or update queries, the library improperly traverses inherited object properties and overwrites shared built-in functions. A remote attacker can exploit this vulnerability by submitting crafted document keys to cause a Deni...
CVE-2025-51495
I would like to report a security vulnerability identified in the latest release of Mongoose v7.17. The issue resides in the WebSocket module, specifically within the mgwscb function responsible for handling incoming WebSocket frames. The function is vulnerable to an integer overflow, which may...
EUVD-2026-120497
Mongoose: Discriminator key values matching inherited properties e.g. t: 'constructor' bypass schema casting and can poison collections...
EUVD-2026-120498
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions denial of service and shared schema state...
npm: Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
npm: Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions denial of service and shared schema state vulnerability discovered by ? in WordPress npm mongoose versions 6.13.12...
EUVD-2026-120501
Mongoose: Prototype pollution via Schema.prototype.virtual...
EUVD-2026-120502
Mongoose: Connection-level sanitizeFilter not applied...
GHSA-PCRW-H46H-C93H Mongoose: sanitizeFilter not applied on countDocuments
Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...
npm: Mongoose: sanitizeFilter not applied on countDocuments
npm: Mongoose: sanitizeFilter not applied on countDocuments vulnerability discovered by ? in WordPress npm mongoose versions 6.13.11...
Mongoose: sanitizeFilter not applied on countDocuments
Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...