Express — PoC Archivehttps://poc.intelseclab.com/tags/express/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Critical severity (CVSS 9) — web · CVE-2025-23061. Status: Weaponized. Affects: Mongoose (Node.js MongoDB ODM). Tags: mongoose, nodejs, nosql-injection, mongodb, populate, where-operator, command-injection, rce, cwe-943, cwe-94, express.webCriticalmongoosenodejsnosql-injectionmongodbpopulatewhere-operatorcommand-injectionrcecwe-943cwe-94expressSequelize ORM JSON Cast SQL Injection — CVE-2026-30951https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/High severity — web · CVE-2026-30951. Status: PoC. Affects: Sequelize ORM v6 (Node.js). Tags: sequelize, sqli, orm, json-cast, nodejs, express, sqlite, boolean-based.webHighsequelizesqliormjson-castnodejsexpresssqliteboolean-basedNode.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Critical severity — web · CVE-2026-41242. Status: PoC. Affects: Node.js application using protobufjs (Root.fromJSON + dynamic decode). Tags: nodejs, protobufjs, rce, deserialization, express, code-injection, javascript.webCriticalnodejsprotobufjsrcedeserializationexpresscode-injectionjavascriptMulter Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/High severity (CVSS 8.7) — web · CVE-2026-3304. Status: PoC. Affects: Multer (Node.js multipart/form-data middleware for Express). Tags: multer, nodejs, express, dos, file-upload, orphaned-file, disk-exhaustion, multipart.webHighmulternodejsexpressdosfile-uploadorphaned-filedisk-exhaustionmultipartHandlebars AST Injection Remote Code Execution — CVE-2026-33937https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Critical severity — web · CVE-2026-33937. Status: PoC. Affects: Handlebars (Node.js templating engine). Tags: handlebars, rce, template-injection, ast-injection, nodejs, express, javascript-compiler, code-generation.webCriticalhandlebarsrcetemplate-injectionast-injectionnodejsexpressjavascript-compilercode-generation