https://poc.intelseclab.com/tags/json-injection/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-54350-budibase-nosql-injection/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-54350-budibase-nosql-injection/Critical severity (CVSS 10) — web · CVE-2026-54350 (GHSA-8qv3-p479-cj62). Status: Weaponized — reproduced end-to-end against a real budibase/budibase:3.39.0 instance. Affects: Budibase (open-source low-code application platform) — POST /api/v2/queries/:queryId. Tags: budibase, nosql-injection, mongodb, unauthenticated, low-code, json-injection.webCriticalbudibasenosql-injectionmongodbunauthenticatedlow-codejson-injection