Data-Exposure — PoC Archivehttps://poc.intelseclab.com/tags/data-exposure/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Critical severity (CVSS 9.1) — web · CVE-2025-64459. Status: Weaponized. Affects: Django ORM (QuerySet.filter() / Q object construction). Tags: django, python, sql-injection, queryset, q-object, orm, cwe-89, data-exposure, sqlite.webCriticaldjangopythonsql-injectionquerysetq-objectormcwe-89data-exposuresqliteRealtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/High severity (CVSS 7.4) — web · CVE-2026-27579 (GHSA-qh5m-p8jh-hx88). Status: PoC. Affects: realtime-collaboration-platform (karnop), backed by Appwrite. Tags: cors, misconfiguration, appwrite, cross-origin, credentials, data-exposure, session-hijack, javascript.webHighcorsmisconfigurationappwritecross-origincredentialsdata-exposuresession-hijackjavascript