NoSQL Injection · passage 7 of 10
1 code block · NoSQL Injection/README.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHub**Remove pre-condition**: In MongoDB, if a document contains duplicate keys, only the last occurrence of the key will take precedence.
{"id":"10", "id":"100"}In this case, the final value of "id" will be "100".
Source: NoSQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 10 is a mark on the map. Named now: 1 to 10, reading order first.
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.