Rce

An exposed Jupyter server on port 8888. A notebook is a code-execution primitive by design.

Improper path validation in Cisco NDFC lets an authenticated, low-privileged attacker upload code via SCP path traversal and execute it with root privileges.

Improper authorization and insufficient argument validation in the Cisco NDFC REST API and web UI let an authenticated, low-privileged attacker execute arbitrary commands on …

An Express backend ran the needle HTTP library in a way that turned a JSON field into an implicit file upload, which dropped a Python file the server then executed.

The picker fed user input through a shell, so a short reverse shell over an ngrok tunnel gave a session and the flag.

Missing input validation in the BitBake Toaster server (Yocto Project) lets a remote, unauthenticated attacker execute arbitrary OS commands via a crafted HTTP request.