Graphql — PoC Archivehttps://poc.intelseclab.com/tags/graphql/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Vendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25050-vendure-user-enum/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25050-vendure-user-enum/Medium severity — web · CVE-2026-25050. Status: PoC. Affects: Vendure (NativeAuthenticationStrategy.authenticate(), Admin GraphQL API). Tags: vendure, graphql, timing-attack, user-enumeration, authentication, python, cwe-208, brute-force-enabler.webMediumvenduregraphqltiming-attackuser-enumerationauthenticationpythoncwe-208brute-force-enablerSaleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/High severity — web · CVE-2026-23499. Status: PoC. Affects: Saleor (saleor/saleor). Tags: saleor, stored-xss, unrestricted-file-upload, svg-xss, session-hijack, graphql, javascript.webHighsaleorstored-xssunrestricted-file-uploadsvg-xsssession-hijackgraphqljavascriptSaleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/High severity — web · CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv). Status: PoC. Affects: Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products). Tags: saleor, stored-xss, editorjs, graphql, ecommerce, session-hijacking, cwe-79.webHighsaleorstored-xsseditorjsgraphqlecommercesession-hijackingcwe-79Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/High severity (CVSS 7.5) — web · CVE-2026-24136. Status: PoC. Affects: Saleor e-commerce platform (GraphQL API). Tags: saleor, graphql, idor, bola, cwe-639, pii-leak, unauthenticated, e-commerce.webHighsaleorgraphqlidorbolacwe-639pii-leakunauthenticatede-commerceGitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5173-gitlab-websocket-graphql-bypass/High severity — web · CVE-2026-5173. Status: PoC. Affects: GitLab CE/EE, ActionCable WebSocket endpoint (/-/cable), GraphqlChannel. Tags: gitlab, websocket, graphql, actioncable, graphqlchannel, information-disclosure, broken-access-control.webHighgitlabwebsocketgraphqlactioncablegraphqlchannelinformation-disclosurebroken-access-controlDagster Database I/O Manager SQL Injection via Dynamic Partition Keys (CVE-2026-41490)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41490-dagster-partition-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41490-dagster-partition-sqli/High severity — web · CVE-2026-41490 (GHSA-mjw2-v2hm-wj34). Status: PoC. Affects: Dagster database I/O manager integrations: dagster-duckdb, dagster-snowflake, dagster-gcp (BigQuery), dagster-deltalake, dagster-snowflake-polars. Tags: dagster, sql-injection, graphql, duckdb, snowflake, bigquery, data-pipeline, dynamic-partitions.webHighdagstersql-injectiongraphqlduckdbsnowflakebigquerydata-pipelinedynamic-partitions