CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23061
https://notcve.org/view.php?id=CVE-2025-23061
15 Jan 2025 — Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. • https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2905 – Cesanta Mongoose MQTT Message Parsing Heap Overflow
https://notcve.org/view.php?id=CVE-2023-2905
09 Aug 2023 — Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11. Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddabl... • https://github.com/cesanta/mongoose/pull/2274 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •