Saleor — PoC Archivehttps://poc.intelseclab.com/tags/saleor/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/High severity — web · CVE-2026-23499. Status: PoC. Affects: Saleor (saleor/saleor). Tags: saleor, stored-xss, unrestricted-file-upload, svg-xss, session-hijack, graphql, javascript.webHighsaleorstored-xssunrestricted-file-uploadsvg-xsssession-hijackgraphqljavascriptSaleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22849-saleor-richtext-stored-xss/High severity — web · CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv). Status: PoC. Affects: Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products). Tags: saleor, stored-xss, editorjs, graphql, ecommerce, session-hijacking, cwe-79.webHighsaleorstored-xsseditorjsgraphqlecommercesession-hijackingcwe-79Saleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/High severity (CVSS 7.5) — web · CVE-2026-24136. Status: PoC. Affects: Saleor e-commerce platform (GraphQL API). Tags: saleor, graphql, idor, bola, cwe-639, pii-leak, unauthenticated, e-commerce.webHighsaleorgraphqlidorbolacwe-639pii-leakunauthenticatede-commerce