Rockmongo is a web-based MongoDB administration tool with a narrow, focused product scope and exhibits recurring input-handling vulnerabilities characteristic of web interfaces, particularly cross-site scripting and path-traversal issues. Current severity, exploitation activity, and exposure metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rockmongo over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-53938MEDIUM RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can ex | Dec 18, 2025 | 5.4 | 19 | NO | NO |
CVE-2013-5108MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) db p | Dec 5, 2013 | 4.3 | 17 | NO | NO |
CVE-2013-5107MEDIUM Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the ROCK_LANG cookie, as demonstrated in a lo | Dec 14, 2013 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rockmongo.
Media articles that mention a CVE ID that affects a product developed by Rockmongo — matched by CVE ID, not by vendor name.