CVE-2025-23061

This repository contains a functional PoC for CVE-2025-23061, demonstrating a NoSQL injection vulnerability in a Node.js application using MongoDB. The exploit leverages improper JSON parsing in query parameters to manipulate MongoDB queries, allowing unauthorized data access or manipulation.

This repository contains a functional proof-of-concept exploit for CVE-2025-23061, demonstrating command injection in Mongoose via nested `$where` operators in the `populate()` function's match option. The exploit includes examples for information disclosure, authentication bypass, and DoS attacks.