Sqlite — PoC Archivehttps://poc.intelseclab.com/tags/sqlite/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Critical severity (CVSS 9.1) — web · CVE-2025-64459. Status: Weaponized. Affects: Django ORM (QuerySet.filter() / Q object construction). Tags: django, python, sql-injection, queryset, q-object, orm, cwe-89, data-exposure, sqlite.webCriticaldjangopythonsql-injectionquerysetq-objectormcwe-89data-exposuresqliteSequelize ORM JSON Cast SQL Injection — CVE-2026-30951https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/High severity — web · CVE-2026-30951. Status: PoC. Affects: Sequelize ORM v6 (Node.js). Tags: sequelize, sqli, orm, json-cast, nodejs, express, sqlite, boolean-based.webHighsequelizesqliormjson-castnodejsexpresssqliteboolean-basedNezha Dashboard Path Traversal → JWT Secret Leak → Token Forgery — CVE-2026-53519https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53519-nezha-path-traversal-jwt-forgery/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-53519-nezha-path-traversal-jwt-forgery/Info severity — web · CVE-2026-53519 (GHSA-5c25-7vpj-9mqh). Status: PoC. Affects: Nezha Dashboard (monitoring/agent management panel). Tags: nezha, path-traversal, jwt-forgery, unauthenticated, config-disclosure, sqlite, privilege-escalation, cwe-22, cwe-347.webInfonezhapath-traversaljwt-forgeryunauthenticatedconfig-disclosuresqliteprivilege-escalationcwe-22cwe-347Ghost CMS Content API — Unauthenticated Blind SQL Injection (CVE-2026-26980)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Critical severity — web · CVE-2026-26980. Status: Weaponized. Affects: Ghost CMS. Tags: ghost-cms, sql-injection, blind-sqli, content-api, unauthenticated, boolean-oracle, mysql, sqlite.webCriticalghost-cmssql-injectionblind-sqlicontent-apiunauthenticatedboolean-oraclemysqlsqlite