Lucene search
+L

8 matches found

Kitploit
Kitploit
added 2026/08/31 3:49 p.m.2 views

CVE-2025-23061

CVE-2025-23061 - Mongoose 命令注入 针对 Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 与 CVE-2025-23061 时间线 2024年11月7日: Dat Phung 在 Mongoose 中发现了一个严重漏洞,并向 Snyk 提交了安全报告。 2024年11月26日: Mongoose 发布版本 8.8.3 以修复该漏洞。 2024年12月2日: 国家漏洞数据库 NVD 针对该漏洞披露了 CVE-2024-53900。 2024年12月17日: 在分析 Mongoose 8.8.3 补丁后,Dat Phung...

9.8CVSS7.4AI score0.07284EPSS
SaveExploits3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.80 views

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

9.8CVSS7.6AI score0.07284EPSS
SaveExploits3References4
Kitploit
Kitploit
added 2026/08/30 11:44 a.m.3 views

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where 远程代码执行(RCE) 本仓库提供了一个可复现的漏洞环境及针对 CVE-2024-53900 的概念验证(PoC),该漏洞是 Mongoose 8.8.3 中的一个严重远程代码执行(RCE)漏洞。 📌 漏洞详情 CVE : CVE-2024-53900 受影响的版本 : Mongoose 8.8.3 严重性 : 严重(CVSS 9.1) 攻击向量 : populate.match 与 $where 结合 影响 : 在 Node.js 环境中执行任意 JavaScript(RCE) 参考资料:...

9.1CVSS7.4AI score0.03988EPSS
SaveExploits3References2
OSV
OSV
added 2025/09/25 8:46 a.m.9 views

BIT-MONGOOSE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

9.8CVSS7AI score0.07284EPSS
SaveExploits1References5
GithubExploit
GithubExploit
added 2025/08/19 10:20 a.m.536 views

Exploit for CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE This r...

9.1CVSS9.8AI score0.03988EPSS
SaveExploits3
Veracode
Veracode
added 2025/01/22 5:17 a.m.13 views

Search Injection

Mongoose is vulnerable to Search Injection. The vulnerability is due to improper handling of a nested $where filter with a populate match, allows the improper handling of a nested $where filter with a populate match, which can be exploited for search injection attacks...

9.8CVSS6.9AI score0.07284EPSS
SaveExploits1References10Affected Software1
Vulnrichment
Vulnrichment
added 2025/01/15 12:00 a.m.26 views

CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...

9CVSS9.4AI score0.07284EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2025/01/13 12:00 a.m.7 views

PT-2025-4804

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...

9.8CVSS9.1AI score0.07284EPSS
SaveExploits3References38
Rows per page
Query Builder