Fastapi — PoC Archivehttps://poc.intelseclab.com/tags/fastapi/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Ormar ORM SQL Injection via min()/max() Aggregate Methods (CVE-2026-26198)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Critical severity (CVSS 9.8) — web · CVE-2026-26198 (GHSA-xxh2-68g9-8jqr). Status: PoC. Affects: Ormar (async Python ORM, commonly used with FastAPI/Starlette). Tags: sql-injection, python, ormar, orm, fastapi, sqlalchemy, cwe-89, unauthenticated.webCriticalsql-injectionpythonormarormfastapisqlalchemycwe-89unauthenticatedLiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-49468. Status: PoC. Affects: LiteLLM (BerriAI) proxy. Tags: litellm, llm-proxy, auth-bypass, host-header, route-confusion, cwe-290, fastapi, starlette, python.webCriticallitellmllm-proxyauth-bypasshost-headerroute-confusioncwe-290fastapistarlettepythonAutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/High severity (CVSS 7.1) — web · CVE-2026-30950 (GHSA-q58p-v9r9-7gqj). Status: PoC. Affects: AutoGPT Platform (autogpt-platform-backend, chat/copilot feature). Tags: autogpt, idor, cwe-862, session-hijack, missing-authorization, python, fastapi, redis.webHighautogptidorcwe-862session-hijackmissing-authorizationpythonfastapiredis