CVE-2024-53900

CTF Challenge - Mongoose RCE CVE-2024-53900 Challenge Overview This Capture The Flag CTF challenge is based on CVE-2024-53900, a vulnerability in Mongoose that allows Remote Code Execution RCE due to improper use of the $where operator in MongoDB queries. Your objective is to exploit this...

sift-hardened

sift-hardened Reemplazo directo de sift 17.1.3 que corrige CVE-2026-85625. No está afiliado con crcn/sift.js. Cambios respecto a 17.1.3 Las claves de consulta se enumeran con Object.keys solo propiedades propias, por lo que un Object.prototype.$where contaminado no se trata como un operador. Los...

CVE-2024-53900

es-define-property Object.defineProperty, but not IE 8's broken one. Example root@kitploit: const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty...

CVE-2026-85625

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

CVE-2026-85625

sift (sift.js) 17.1.3 is vulnerable to remote code execution due to its use of for...in to enumerate query keys, which walks the object prototype chain and dispatches any matched operator key including $where . The $where operator compiles a string value into a function via new Function unless CS...

CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

EUVD-2026-71232

sift sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set not set by default. As a result, if a...

PT-2026-85549

Name of the Vulnerable Software and Affected Versions sift sift.js versions prior to 17.1.4 Description The software enumerates query keys using a for...in loop, which traverses the object prototype chain and dispatches matched operator keys, including $where. The $where operation compiles a stri...

EUVD-2026-57821

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

PT-2026-71445

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

The vulnerability of the populate() function in the Mongoose library allows a hacker to execute arbitrary code and gain access to read and modify data.

The vulnerability of the populate function in the Mongoose library is related to improper code generation when using the $where operator. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain access to read and modify data...

The vulnerability of the Mongoose library, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary code and gain access to read and modify data.

The vulnerability of the Mongoose library relates to the lack of protection for the SQL query structure when the $where operator is used. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain access to read and modify data...

GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

PT-2024-35970

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...