lukasz-rybak/CVE-2026-23499

PoC

CVE-2026-23499 - Saleor vulnerable to stored XSS via Unrestricted File Upload

view exploit source poc_in_githubauthor lukasz-rybakpublished 2026-04-11catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-23499US	medium5.4	0.27% (20th)	Exploit	2026-01-21
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitra…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.