Laravel Mongodb (Php)
Approved changes feed: RSS · Atom
cpe:2.3:a:mongodb:laravel_mongodb_(php):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mongodb (1aa156a6-63a9-5032-baaf-10197d408a1e) |
|---|---|
| Product | Laravel Mongodb (Php) (abd05c1f-cf8b-5afa-b693-37bc0e1120cc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88027 |
vulnerable | 2026-09-16 04:34:09.297025 |
Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel
HIGH (7.1)
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.
Published: 2026-09-10T17:52:16.685Z
Updated: 2026-09-10T18:22:21.724Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88022 |
vulnerable | 2026-09-16 04:34:09.225025 |
Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel
HIGH (7.7)
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.
Published: 2026-09-10T17:37:03.087Z
Updated: 2026-09-10T18:12:12.204Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88028 |
vulnerable | 2026-09-16 04:34:09.206887 |
Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel
MEDIUM (6.5)
Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.
Published: 2026-09-10T17:54:31.249Z
Updated: 2026-09-10T18:24:40.612Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.