CVE-2026-93759

HighCVSS 8.6/10Last modified Sep 24, 2026

Description

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-93766.3A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave o CVE-2026-937608.2Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-b CVE-2026-937617.5An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent CVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl CVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl CVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl CVE-2026-937659.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are p CVE-2026-937676.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter CVE-2026-937697.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-admini CVE-2026-93772.4A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/pro CVE-2026-937707.1Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-937717.2Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.