Low-Code — PoC Archivehttps://poc.intelseclab.com/tags/low-code/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000Budibase Unauthenticated NoSQL Operator Injection (CVE-2026-54350)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-54350-budibase-nosql-injection/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-54350-budibase-nosql-injection/Critical severity (CVSS 10) — web · CVE-2026-54350 (GHSA-8qv3-p479-cj62). Status: Weaponized — reproduced end-to-end against a real budibase/budibase:3.39.0 instance. Affects: Budibase (open-source low-code application platform) — POST /api/v2/queries/:queryId. Tags: budibase, nosql-injection, mongodb, unauthenticated, low-code, json-injection.webCriticalbudibasenosql-injectionmongodbunauthenticatedlow-codejson-injectionBudibase Authentication Bypass to Plugin-Upload Reverse Shell — CVE-2026-31816https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Critical severity — web · CVE-2026-31816. Status: Weaponized. Affects: Budibase (low-code platform). Tags: budibase, auth-bypass, rce, plugin-upload, reverse-shell, low-code, python, datasource-plugin.webCriticalbudibaseauth-bypassrceplugin-uploadreverse-shelllow-codepythondatasource-pluginAppsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Critical severity (CVSS 9.1) — web · CVE-2026-30862 (GHSA-5hw4-whxv-6794). Status: PoC. Affects: Appsmith. Tags: appsmith, stored-xss, csrf, privilege-escalation, xsrf-token, react, low-code.webCriticalappsmithstored-xsscsrfprivilege-escalationxsrf-tokenreactlow-code