Ctrl + K
/ news / CVE
CVE•Published 2025-12-19•3 articles on news•5 live references•NVD data

CVE-2025-14847

Vulnerability data via CVEDB (Shodan)

CISA KEVKnown exploited in the wild.
CISA action: MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
CVSS v3.1
8.7
HIGH
EPSS percentile
100
Exploit Prediction Scoring System · top 0% of all CVEs
Description

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Timeline
Published 2025-12-19

External references

NVDMITREExploit-DBGitHub PoCVulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag37,434 hosts
vuln:CVE-2025-14847
Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product + version
product:"Mongodb Mongodb" version:"3.6.0"
Version-pinned fingerprint from NVD's first vulnerable CPE.
Shodan · banner/body mention
http.html:"Mongodb"
HTTP body or banner mentions "Mongodb" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2025-14847
Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2025-14847
Censys host search filtered to this CVE id.
grep.app
CVE-2025-14847
Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2025-14847
GitHub code search for direct mentions.
Google dork
"CVE-2025-14847" exploit -site:nvd.nist.gov
Write-ups and news, NVD excluded.

Known PoCs on GitHub (8)

CVE-2025-148478 repos
Mr-xn/Penetration_Testing_POCHTML
渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypas…
★ 7,501·updated 1w ago
k8gege/LadonC#
Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\S…
★ 5,328·updated 1y ago
Threekiii/Awesome-POCJava
一个漏洞 PoC 知识库。A knowledge base for vulnerability PoCs(Proof of Concept), with 1k+ vulnerabilities.
★ 5,211·updated 5mo ago
0xsyr0/OSCPPowerShell
OSCP Cheat Sheet
★ 3,860·updated 4w ago
joe-desimone/mongobleedJavaScript
★ 946·updated 9mo ago
Ostorlab/KEVunknown
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
★ 619·updated 1w ago
getindiekit/indiekitJavaScript
The little Node.js server with all the parts needed to publish content to your personal website and share it on social networks.
★ 392·updated 1w ago
Threekiii/CVEunknown
一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.
★ 180·updated 2mo ago
Articles on news mentioning CVE-2025-14847