PoC Archive PoC Archive

tag

Mongodb

Budibase Unauthenticated NoSQL Operator Injection (CVE-2026-54350)
CVE-2026-54350 (GHSA-8qv3-p479-cj62) web Patched
CVE-2026-54350webCRITICAL 10Patched2026-07-27Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)
CVE-2025-23061 web Patched
CVE-2025-23061webCRITICAL 9Patched2026-07-06Rocket.Chat OAuth2 NoSQL Injection Privilege Escalation — CVE-2026-29198
CVE-2026-29198 web Patched
CVE-2026-29198webCRITICALPatched2026-07-05