Django — PoC Archivehttps://poc.intelseclab.com/tags/django/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000XSpeeder SXZOS Pre-Auth eval() Remote Code Execution (CVE-2025-54322)https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-54322-xspeeder-sxzos-preauth-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-54322-xspeeder-sxzos-preauth-rce/Critical severity (CVSS 10) — network · CVE-2025-54322. Status: Weaponized. Affects: XSpeeder SXZOS firmware (SD-WAN devices, routers, edge networking equipment). Tags: xspeeder, sxzos, sd-wan, router, firmware, python, django, eval-injection, pre-auth, rce, cwe-95.networkCriticalxspeedersxzossd-wanrouterfirmwarepythondjangoeval-injectionpre-authrcecwe-95Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Critical severity (CVSS 9.1) — web · CVE-2025-64459. Status: Weaponized. Affects: Django ORM (QuerySet.filter() / Q object construction). Tags: django, python, sql-injection, queryset, q-object, orm, cwe-89, data-exposure, sqlite.webCriticaldjangopythonsql-injectionquerysetq-objectormcwe-89data-exposuresqliteTandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25964-tandoor-recipes-lfi/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25964-tandoor-recipes-lfi/Medium severity (CVSS 4.9) — web · CVE-2026-25964 (GHSA-6485-jr28-52xx). Status: PoC. Affects: Tandoor Recipes (self-hosted recipe manager, Django-based). Tags: path-traversal, local-file-disclosure, tandoor-recipes, django, rest-api, authenticated, cwe-22, arbitrary-file-read.webMediumpath-traversallocal-file-disclosuretandoor-recipesdjangorest-apiauthenticatedcwe-22arbitrary-file-readDjango MultiPartParser Base64 Whitespace CPU Amplification DoS — CVE-2026-33033https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33033-django-multipartparser-dos/Medium severity — web · CVE-2026-33033. Status: PoC. Affects: Django (django.http.multipartparser.MultiPartParser). Tags: django, dos, multipart, base64, cpu-amplification, python, file-upload.webMediumdjangodosmultipartbase64cpu-amplificationpythonfile-uploadDjango GIS RasterField SQL Injection (CVE-2026-1207)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1207-django-gis-rasterfield-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1207-django-gis-rasterfield-sqli/High severity — web · CVE-2026-1207. Status: PoC. Affects: Django django.contrib.gis (GeoDjango) RasterField queries. Tags: django, gis, geodjango, sql-injection, rasterfield, postgis, python.webHighdjangogisgeodjangosql-injectionrasterfieldpostgispython