corpus.blog
42,390 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0fcb0-b475-70f0-8435-478f53925f09

ORM Leaking More Than You Joined For - elttam

elttam.com · published 24 March 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at elttam.com Wayback capture
1blogs citing
First cited
21 Dec 2025
Most recent
21 Dec 2025
Rank this month
not ranked
External links
36
Words captured
6,124

Cited by

Blog
In the post
Date
PentesterLab
Research Worth Reading Week 51/2025 Read at the source ↗
21 Dec 2025

Links from this post

Link
Host
https://blackhat.com/eu-25/briefings/schedule/
blackhat.com
https://github.com/beego/beego
github.com
https://github.com/goharbor/harbor
github.com
https://semgrep.dev/
semgrep.dev
https://github.com/elttam/plormber
github.com
https://github.com/goharbor/harbor/blob/v2.12.2/src/lib/orm/query.go
github.com
https://github.com/goharbor/harbor/blob/v2.13.0/src/lib/orm/metadata.go
github.com
https://github.com/goharbor/harbor/blob/v2.13.0/src/pkg/user/dao/user.go
github.com
https://github.com/goharbor/harbor/blob/v2.13.0/src/lib/orm/query.go
github.com
https://github.com/beego/beego/blob/v2.3.8/client/orm/db_tables.go
github.com
https://github.com/goharbor/harbor/blob/v2.13.1-rc1/src/lib/orm/query.go
github.com
https://github.com/goharbor/harbor/blob/v2.13.1-rc1/src/lib/q/builder.go
github.com
https://github.com/goharbor/harbor/blob/v2.14.0/src/lib/orm/query.go
github.com
https://www.ghostccamm.com/blog/strapi_filter_bypass_vuln/
ghostccamm.com
https://www.ghostccamm.com/blog/multi_strapi_vulns/
ghostccamm.com
https://sequelize.org/
sequelize.org
https://expressjs.com/
expressjs.com
https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work
portswigger.net
https://portswigger.net/web-security/nosql-injection
portswigger.net
https://expressjs.com/en/4x/api.html
expressjs.com
https://expressjs.com/en/5x/api.html
expressjs.com
https://expressjs.com/en/resources/middleware/cookie-parser.html
expressjs.com
https://learn.microsoft.com/en-us/dotnet/csharp/linq/how-to-build-dynamic-queries
learn.microsoft.com
https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh
github.com
https://positive.security/blog/ransack-data-exfiltration
positive.security
https://github.com/activerecord-hackery/ransack
github.com
https://learn.microsoft.com/en-us/odata/webapi-8/overview
learn.microsoft.com
https://docs.oasis-open.org/odata/odata/v4.01/odata-v4.01-part2-url-conventions.html
docs.oasis-open.org
https://media.blackhat.com/ad-12/Kalra/bh-ad-12-Oyedata-Kalra-slides.pdf
media.blackhat.com
https://learn.microsoft.com/en-us/odata/webapi/odata-security
learn.microsoft.com
https://docs.oasis-open.org/odata/odata/v4.01/os/part1-protocol/odata-v4.01-os-part1-protocol.html
docs.oasis-open.org
ORM Leak Exploitation Against SQLite Read at the source ↗
pentesterlab.com
https://github.com/elttam/semgrep-rules/blob/main/rules-audit/python/orm-leak/django-orm.yaml
github.com
https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/data_manager/managers.py
github.com
https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6hjj-gq77-j4qw
github.com
https://github.com/elttam/semgrep-rules
github.com
Elsewhere on elttam.com (2)