CVE-2026-93760

HighCVSS 8.2/10Last modified Sep 24, 2026

Description

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-943

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-937617.5An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent CVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl CVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl CVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl CVE-2026-937659.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are p CVE-2026-937676.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter CVE-2026-937697.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-admini CVE-2026-93772.4A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/pro CVE-2026-937707.1Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.CVE-2026-937717.2Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.CVE-2026-937726.5Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.CVE-2026-937738.5Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.