PoC Archive PoC Archive

tag

Mongodb

Critical
Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)
CVE-2025-23061· Mongoose (Node.js MongoDB ODM) unpatched
Critical
Rocket.Chat OAuth2 NoSQL Injection Privilege Escalation — CVE-2026-29198
CVE-2026-29198· Rocket.Chat (OAuth2 login flow) patched