Search for packages
| purl | pkg:npm/mongo-express@0.40.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-9zpn-rzfs-pyfg
Aliases: CVE-2019-10758 GHSA-h47j-hc6x-h3qq |
Remote Code Execution Vulnerability in NPM mongo-express Remote code execution on the host machine by any authenticated user. |
Affected by 4 other vulnerabilities. |
|
VCID-kas3-jua6-hqer
Aliases: CVE-2021-23372 GHSA-m2r3-8492-vx59 |
Improper Check for Unusual or Exceptional Conditions Mongo-express is vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. | There are no reported fixed by versions. |
|
VCID-nr2n-pfu7-afat
Aliases: CVE-2020-24391 GHSA-hxmg-hm46-cf62 |
Javascript Injection mongo-express offers support for certain advanced syntax but implements this in an unsafe way |
Affected by 2 other vulnerabilities. |
|
VCID-quer-e8mx-eyg2
Aliases: CVE-2021-21422 GHSA-7p8h-86p5-wv3p |
Cross-site Scripting mongo-express is a web-based MongoDB admin interface, written with Node.js and express. |
Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-wjdj-n2qp-u3aw
Aliases: CVE-2023-52555 GHSA-fffg-cwc9-xvj7 |
mongo-express Cross-site Request Forgery vulnerability In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||