Monthly
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
Regex metacharacter injection in the MongoDB C# Driver's LINQ query translation layer allows an authenticated low-privilege user to alter generated regular-expression predicates, causing the application to return database records beyond those the original filter was designed to expose. The vulnerability, reported by MongoDB and tracked under CSHARP-6177 (CWE-943), requires only network access and a low-privilege account - making it a meaningful access-control risk in any .NET application that incorporates user input into LINQ regex-based queries against MongoDB. No public exploit has been identified at time of analysis, and no EPSS or KEV data is present in available intelligence.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
SPL injection in Splunk Enterprise exposes all indexed data and compromises search integrity for any low-privileged authenticated user. Specifically, users without the 'admin' or 'power' role can inject Search Processing Language commands into saved-search dispatch requests by supplying malicious time values that Splunk Enterprise fails to validate. Patch versions have been released across all supported branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored SPL injection in Splunk Enterprise allows an unauthenticated attacker who can reach the management port to register a crafted Deployment Server client identity containing malicious Search Processing Language code, which executes when an administrator opens the Add Data forwarder workflow. All four supported major branches are affected (9.4.x, 10.0.x, 10.2.x, 10.4.x), with vendor-confirmed fixes available. No public exploit has been identified at time of analysis, but successful exploitation yields full confidentiality, integrity, and availability impact on the Splunk platform instance.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
Regex metacharacter injection in the MongoDB C# Driver's LINQ query translation layer allows an authenticated low-privilege user to alter generated regular-expression predicates, causing the application to return database records beyond those the original filter was designed to expose. The vulnerability, reported by MongoDB and tracked under CSHARP-6177 (CWE-943), requires only network access and a low-privilege account - making it a meaningful access-control risk in any .NET application that incorporates user input into LINQ regex-based queries against MongoDB. No public exploit has been identified at time of analysis, and no EPSS or KEV data is present in available intelligence.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
SPL injection in Splunk Enterprise exposes all indexed data and compromises search integrity for any low-privileged authenticated user. Specifically, users without the 'admin' or 'power' role can inject Search Processing Language commands into saved-search dispatch requests by supplying malicious time values that Splunk Enterprise fails to validate. Patch versions have been released across all supported branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored SPL injection in Splunk Enterprise allows an unauthenticated attacker who can reach the management port to register a crafted Deployment Server client identity containing malicious Search Processing Language code, which executes when an administrator opens the Add Data forwarder workflow. All four supported major branches are affected (9.4.x, 10.0.x, 10.2.x, 10.4.x), with vendor-confirmed fixes available. No public exploit has been identified at time of analysis, but successful exploitation yields full confidentiality, integrity, and availability impact on the Splunk platform instance.