979 matches found
The vulnerability of the populate() function in the Mongoose library allows a hacker to execute arbitrary code and gain access to read and modify data.
The vulnerability of the populate function in the Mongoose library is related to improper code generation when using the $where operator. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain access to read and modify data...
CVE-2024-22187
A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to an arbitrary write. An attacker can send an unauthenticated packet to trigger this...
GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability
Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...
CVE-2025-23061
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...
CVE-2025-23061: Improper Control of Generation of Code
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900...
PT-2025-4804
Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.9.5 Mongoose versions prior to 7.8.4 Mongoose versions prior to 6.13.6 Description Mongoose is susceptible to a search injection issue due to the improper handling of nested $where filters when used with populate...
Chatwoot SQL注入漏洞
Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A SQL injection vulnerability exists in Chatwoot versions prior to 3.16.0 that stems from improper input cleanup and allows an attacker t...
PT-2025-39179
Name of the Vulnerable Software and Affected Versions LibTIFF versions prior to 4.7.0 LibTIFF version 4.7.0 Description A flaw exists in LibTIFF that results in a "write-what-where" condition. This issue is triggered when the library processes a specially crafted TIFF image file. An attacker can...
Withdrawn Advisory: Nette Database SQL injection
Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...
GHSA-F626-677R-J5VQ Withdrawn Advisory: Nette Database SQL injection
Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...
PT-2024-36561 · Nette · Nette Database
Name of the Vulnerable Software and Affected Versions: Nette Database versions 3.2.4 and earlier Description: The issue allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. This occurs when there's an untrusted filter sent straight ...
CVE-2024-55586
Nette Database versions 3.2.4 and earlier are susceptible to SQL injection when an untrusted filter is passed directly to the where method . This vulnerability allows an attacker to manipulate database query logic by constructing malicious SQL statements. Notably, the vendor maintains that this b...
CVE-2024-55586: Improper Neutralization of Special Elements used in an SQL Command
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...
CVE-2024-55586
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...
GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...
Mongoose search injection vulnerability
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...
EUVD-2024-3487
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...
CVE-2024-53900
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection...
CVE-2024-53900
Mongoose before version 8.8.3 is vulnerable to a critical NoSQL injection (CWE-89) due to the improper use of the $where operator in match queries. This flaw allows unauthenticated attackers to inject arbitrary JavaScript, potentially leading to Remote Code Execution (RCE) and unauthorized access...
