Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Mongo-express Project Clear all filters
TI-2021-04520 CVE-2021-21422 · GHSA-7p8h-86p5-wv3p

XSS Vulnerability in mongo-express

Priority LOW 38

mongo-express is a web-based MongoDB admin interface, written with Node.js and express.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0157 Published 2021-06-21 Fixed in v1.0.0-alpha.4, 1.0.0-alpha.4 CWE-79
TI-2021-06065 CVE-2021-23372 · GHSA-m2r3-8492-vx59

Denial of service (DoS) in mongo-express

Priority LOW 35

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0091 Published 2021-04-13 No fix listed CWE-754
TI-2019-08023 CVE-2019-10758 · GHSA-h47j-hc6x-h3qq

Code injection in mongo-express

Priority CRITICAL 100KEV

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.84726 Published 2019-12-24 Fixed in 0.54.0 CWE-94