Sploitus

31 exploited vulnerabilities in Mongoose

Vulnerabilities with publicly known exploits

Vendors
Mongoose, Adapt Learning, Cesanta, Alt Linux, Npm, Acme
With known exploits
31
Affected Mongoosejs Mongoose versions
< 6.13.6, 7.8.4, 8.9.5, 6.13.5, 7.8.3, 8.8.3, 7.0.0, 8.0.0
Affected Cesanta Mongoose versions
= 6.8
Affected Shttpd versions
= 1.42
Affected Valenok Mongoose versions
= 3.0, 2.8.0
Affected Yassl Yasslews versions
= 0.2
Affected Sergey Lyubka Mongoose versions
= 2.4

Vulnerabilities with exploits

Highest CVSS first — 11 of these already have exploit code on Sploitus

CVE-2023-3696
CVSS 10.0 CRITICAL 2023-07-16FIX AVAILABLE
CVE-2025-23061 1 exploit
CVSS 9.8 CRITICAL 2025-01-13FIX AVAILABLE
Exploit for Code Injection in Mongoosejs Mongoose
CVE-2024-50672 2 exploits
CVSS 9.8 CRITICAL 2024-11-25FIX AVAILABLE
Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE)📄 Adapt Authoring Tool 0.11.3 Remote Command Execution
CVE-2022-25299
CVSS 9.8 CRITICAL 2022-02-18FIX AVAILABLE
CVE-2019-19307
CVSS 9.8 CRITICAL 2019-11-26
CVE-2017-2922 1 exploit
CVSS 9.8 CRITICAL 2017-11-07
Cesanta Mongoose Websocket Protocol Fragmented Packet Code Execution Vulnerability(CVE-2017-2922)
CVE-2017-2921 1 exploit
CVSS 9.8 CRITICAL 2017-11-07
Cesanta Mongoose Websocket Protocol Packet Length Code Execution Vulnerability(CVE-2017-2921)
CVE-2017-2894 1 exploit
CVSS 9.8 CRITICAL 2017-11-07
Cesanta Mongoose MQTT SUBSCRIBE Multiple Topics Remote Code Execution(CVE-2017-2894)
CVE-2017-2891 1 exploit
CVSS 9.8 CRITICAL 2017-11-07
Cesanta Mongoose HTTP Server CGI Remote Code Execcution Vulnerability(CVE-2017-2891)
CVE-2024-53900 3 exploits
CVSS 9.4 CRITICAL 2024-11-26FIX AVAILABLE
Exploit for Code Injection in Mongoosejs MongooseExploit for CVE-2024-53900
CVE-2018-18765
CVSS 9.1 CRITICAL 2018-10-28
CVE-2018-18764
CVSS 9.1 CRITICAL 2018-10-28FIX AVAILABLE
CVE-2023-2905
CVSS 8.8 HIGH 2023-08-08FIX AVAILABLE
CVE-2020-25887
CVSS 8.8 HIGH 2023-08-22
CVE-2026-11404
CVSS 8.7 HIGH 2026-07-09FIX AVAILABLE
CVE-2026-5246
CVSS 8.1 HIGH 2026-04-02FIX AVAILABLE
CVE-2026-42334
CVSS 7.5 HIGH 2026-05-05FIX AVAILABLE
CVE-2026-6985
CVSS 7.5 HIGH 2026-04-25FIX AVAILABLE
CVE-2025-51495
CVSS 7.5 HIGH 2025-09-29
CVE-2023-34188
CVSS 7.5 HIGH 2023-06-23FIX AVAILABLE
CVE-2019-13503
CVSS 7.5 HIGH 2019-07-11FIX AVAILABLE
CVE-2018-10945
CVSS 7.5 HIGH 2018-06-19
CVE-2017-16077
CVSS 7.5 HIGH 2018-06-07FIX AVAILABLE
CVE-2017-2893 1 exploit
CVSS 7.5 HIGH 2017-11-07
Cesanta Mongoose MQTT SUBSCRIBE Command Denial Of Service(CVE-2017-2893)
CVE-2011-2900 7 exploits
CVSS 7.5 HIGH 2011-08-05FIX AVAILABLE
Simple HTTPd 1.42 PUT Request Remote Buffer Overflow VulnerabilitySimple-HTTPD
CVE-2022-2564
CVSS 7.0 HIGH 2022-07-28FIX AVAILABLE
CVE-2018-19587
CVSS 6.5 MEDIUM 2018-11-27FIX AVAILABLE
CVE-2009-4535 2 exploits
CVSS 5.0 MEDIUM 2009-12-31FIX AVAILABLE
Mongoose Web Server 2.8 - Multiple Directory TraversalsMongoose Web Server 2.8 - Source Disclosure
CVE-2009-4530
CVSS 5.0 MEDIUM 2009-12-31
CVE-2009-1354 1 exploit
CVSS 4.0 MEDIUM 2009-04-21
MonGoose 2.4 (Windows) - WebServer Directory Traversal
CVE-2026-6986
CVSS 3.7 LOW 2026-04-25FIX AVAILABLE