NoSQL Injection · passage 3 of 10

Operator Injection

2 code blocks · NoSQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

| Operator | Description | | -------- | ------------------ | | $ne | not equal | | $regex | regular expression | | $gt | greater than | | $lt | lower than | | $nin | not in | Example: A web application has a product search feature

db.products.find({ "price": userInput })

An attacker can inject a NoSQL query: `{ "$gt": 0 }`.

db.products.find({ "price": { "$gt": 0 } })

Instead of returning a specific product, the database returns all products with a price greater than zero, leaking data.

Every one of the 10 is a mark on the map. Named now: 1 to 10, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.