Laravel Mongodb Php
Monthly
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.