Skip to content
OpenAdvisories

Package · npm

mongo-express

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.1
    CVE-2023-52555

    mongo-express Cross-site Request Forgery vulnerability

    In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.

    mongo-express npm
  • High 8.1
    CVE-2021-21422

    XSS Vulnerability in mongo-express

    mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row wi…

    mongo-express mongo-express mongo-express npm
  • Medium 4.4
    CVE-2021-23372

    Denial of Service (DoS)

    All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.

    mongo-express npm
  • Critical 9.9
    CVE-2019-10758 Exploited Public exploit EPSS 85%

    Remote Code Execution Vulnerability in NPM mongo-express

    mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

    mongo-express npm
    KEV Dec 10, 2021