Mongo-express Project Mongo-express — known CVE vulnerabilities

Every CVE whose affected-product data names Mongo-express Project Mongo-express, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2019-10758 — CVSS 9.9 (critical) — actively exploited: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm`…
• CVE-2020-24391 — CVSS 9.8 (critical): mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap…
• CVE-2021-21422 — CVSS 8.1 (high): mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue…
• CVE-2023-52555 — CVSS 6.1 (medium): In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
• CVE-2021-23372 — CVSS 4.4 (medium): All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an…