Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

MongoDB

Source -

CISACNA

BOS Name -

MongoDB, Inc.

CNA CVEs -

49

ADP CVEs -

0

CISA CVEs -

2

NVD CVEs -

0
Related CVEsRelated ProductsRelated AssignersReports
51Vulnerabilities found
CVE-2019-10758
Assigner-Snyk
ShareView Details
Assigner-Snyk
CVSS Score-9.9||CRITICAL
EPSS-84.84% / 99.69%
||
7 Day CHG~0.00%
Published-24 Dec, 2019 | 21:08
Updated-27 Oct, 2025 | 17:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2022-06-10||Apply updates per vendor instructions.

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Action-Not Available
Vendor-n/aMongoDB, Inc.
Product-mongo-expressmongo-expressmongo-express
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
  • Previous
  • 1
  • 2
  • Next