Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #nosql-injection

2 posts

All topics Clear tag filter

Injection 0||6*7===42

NoSQL Injection4 min read

MongoDB JavaScript Injection: Why $where Must Stay Server-Owned

MongoDB can evaluate JavaScript in legacy query features such as $where. Learn how string construction crosses into code, how to prove it harmlessly, and why MongoDB 8.0 deprecation strengthens the case for removal.

Injection sku[$ne]=

NoSQL Injection4 min read

NoSQL Operator Injection: When a Scalar Field Becomes a Filter

When a parser turns a scalar field into an object, keys such as $ne, $gt and $regex can become MongoDB query logic. Learn both request shapes, a safe proof, and strict schema defenses.