CVE-2020-24391

CRITICAL NUCLEI

mongo-express <1.0.0 - Info Disclosure

Title source: llm

CVE-2020-24391 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Mongo-Express - Remote Code Execution

CRITICALby leovalcante

Shodan: http.title:"mongo express"

FOFA: title="mongo express"

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.7509

EPSS Percentile 99.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Status published

Products (2)

mongo-express_project/mongo-express < 0.54.0

npm/mongodb-query-parser 0 - 2.0.0npm

Published Mar 30, 2021

Tracked Since Feb 18, 2026