TI-2019-08023 CVE-2019-10758 · GHSA-h47j-hc6x-h3qq
Code injection in mongo-express
Priority CRITICAL 100KEV
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Mongo-express Project
Records5All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Mongo-express Project records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Mongo-express · all components
TI-2020-14931 CVE-2020-24391 · GHSA-hxmg-hm46-cf62
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this…
Priority HIGH 81
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way.
TI-2023-28898 CVE-2023-52555 · GHSA-fffg-cwc9-xvj7
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
Priority MEDIUM 60
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
TI-2021-04520 CVE-2021-21422 · GHSA-7p8h-86p5-wv3p
XSS Vulnerability in mongo-express
Priority LOW 38
mongo-express is a web-based MongoDB admin interface, written with Node.js and express.
TI-2021-06065 CVE-2021-23372 · GHSA-m2r3-8492-vx59
Denial of service (DoS) in mongo-express
Priority LOW 35
All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.