Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2025-23061

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.693
EPSS Ranking 98.7%
CVSS Severity
CVSS v3 Score 9.0
Products affected by CVE-2025-23061


Contact Us

Shodan ® - All rights reserved