nosqli

NoSQL Injector A fast NoSQL scanner and injector. For finding sites vulnerable to NoSQL injection, Mongo in particular. About Nosqli I wanted a better nosql injection tool that was simple to use, fully command line based, and configurable. To that end, I began work on nosqli - a simple nosql...

Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

NoSQLMap

NoSQLMap NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases and web applications using NoSQL in order to disclose or clone data from the database. Originally authored by @tcsstool and n...

GraphQLmap

GraphQLmap GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. Install Features and examples Dump a GraphQL schema Interact with a GraphQL endpoint Execute GraphQL queries Autocomplete queries GraphQL field fuzzing Example 1 - Bruteforce a character Examp...

CVE_2020_35848

🧨 CVE‑2020‑35848 – Cockpit CMS 0.11.2 Лаборатория NoSQL-инъекции RCE CVE‑2020‑35848 затрагивает Agentejo Cockpit CMS версий до 0.11.2 и вводит критическую уязвимость NoSQL-инъекции в конечной точке /auth/newpassword. Эта ошибка позволяет неаутентифицированным злоумышленникам внедрять операторы...

CVE-2021-22911

CVE-2021-22911 Rocket Chat 3.12.1에서 인증 전 블라인드 NoSQL 인젝션을 통한 원격 코드 실행 getPasswordPolicy 메서드는 NoSQL 인젝션 공격에 취약하며 인증/권한이 필요하지 않습니다. 비밀번호 재설정 토큰을 유출하여 계정을 탈취하는 데 사용될 수 있습니다. 관리자 계정을 탈취하면 원격 코드 실행이 가능합니다. 설명 1. 사용자 계정 탈취 인증되지 않은 상태 비밀번호 재설정 token 매개변수의 getPasswordPolicy 엔드포인트에 NoSQL 인젝션이 존재하며, 이는 JSON...

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

ninjasworkout

Уязвимое NodeJS приложение Damn Vulnerable Быстрый старт root@kitploit: Download the Repo = run npm i После установки всех зависимостей просто запустите приложение root@kitploit: node app.js or nodemon app.js ДОБАВЛЕННЫЕ УЯЗВИМОСТИ Загрязнение прототипа ✅1 NoSQL-инъекция ✅2 Межсайтовый скриптинг...

CVE-2026-29198-POC

CVE-2026-29198-POC NoSQL-инъекция OAuth2 в Rocket.Chat, версии Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6 и 7.10.9 установка: pip3 install -r requirement.txt Эксплойт: python3 poccve202629198.py --url domain --escalate -v...

Agentejo Cockpit < 0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value. id: CVE-2020-35846 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critic...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi: Утечка токена и сброс пароля Автоматизированный эксплойт для Rocket.Chat и приложений на базе Meteor, который использует NoSQL-инъекцию через выражение $where для утечки токенов сброса пароля через исключения на стороне сервера. После утечки токена скрипт выполняет...

CVE-2026-88027

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

EUVD-2026-75641

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated use...

EUVD-2026-75628

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2024-53900

CTF 챌린지 - Mongoose RCE CVE-2024-53900 챌린지 개요 이 Capture The Flag CTF 챌린지는 Mongoose의 취약점인 CVE-2024-53900을 기반으로 하며, MongoDB 쿼리에서 $where 연산자를 부적절하게 사용하여 원격 코드 실행RCE을 허용합니다. 여러분의 목표는 이 취약점을 악용하여 애플리케이션 내부에 숨겨진 플래그를 검색하는 것입니다! 설정 지침 1 종속성 설치 Node.js가 설치되어 있는지 확인한 후 다음을 실행하세요: root@kitploit: npm install...

Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-168)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-168 advisory. - Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to informatio...

CVE-2021-22911

CVE-2021-22911에 대한 업데이트된 익스플로잇 Rocket.Chat 3.12.1 - NoSQL 인젝션을 통한 RCE 인증 없음 원저작자 크레딧 : https://www.exploit-db.com/exploits/50108 설치 Python 가상 환경을 만들고 의존성을 설치합니다. root@kitploit: $ python -m venv venv $ source venv/bin/activate $ pip install requests oathtool 사용법 낮은 권한 사용자 비밀번호를 입력받고 동일한 비밀번호를 관리자...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB инъекция Описание уязвимости и продукта AhnLab EPP Management — это признанная во всем мире платформа нового поколения для расширенной защиты конечных точек, которая объединяет управление исправлениями, обнаружение сложных вредоносных программ, возможности EDR и XDR...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase 인증되지 않은 NoSQL 연산자 삽입 Budibase에서 인증되지 않은 JSON/NoSQL 연산자 삽입 취약점. 문서 데이터 소스MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, 또는 JSON 본문이 있는 REST를 기반으로 하는 PUBLIC 쿼리를 노출하는 게시된 Budibase 앱의 모든 익명 방문자는 백업 컬렉션의 모든 문서를 읽을 수 있으며 , 공개 쓰기 쿼리가 존재하는 경우 단일 인증되지 않은 HTTP 요청으로 모든 문서를 수정할 ...

nosqli-flintcms

nosqli-flintcms Лабораторное исследование слепой noSQL-инъекции на основе CVE-2018-3783 повышение привилегий в flintcms 1.1.9. Уязвимость была первоначально обнаружена Benoit Côté-Jodoin. Вы можете прочитать оригинальный отчет на HackerOne. Предварительные требования root@kitploit: docker-compose...