Threats Tagged 'ghsa-pmpg-2mxq-6xwr'
View all threats tagged with 'ghsa-pmpg-2mxq-6xwr'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-pmpg-2mxq-6xwr'
Click on any threat for detailed analysis and mitigation recommendations
Server: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete 0 Budibase server versions up to 3.38.1 contain a NoSQL injection vulnerability in the MongoDB integration. This flaw allows BASIC app users to bypass query-level access controls intended to restrict data visibility per user. The vulnerability arises because user input is handlebars-enriched into MongoDB query JSON with no escaping, then parsed and executed without sanitization. Attackers can inject MongoDB operators to manipulate queries and retrieve or modify unauthorized documents. Join the discussion | GCVE Database | 07/24/2026, 21:43:34 UTC Added: 07/25/2026, 23:09:25 UTC |
Showing 1 to 1 of 1 result