Web

Jenkins does not strip tab or newline characters before checking a redirect target for a leading //, so a crafted login link can send a user to an attacker-controlled host.

CTFd 3.8.4 does not strip tab characters before validating a redirect target, so a crafted next= link in the login or registration flow can send a user to an attacker-controlled …

Password reset tokens came from Apache Commons RandomStringUtils on a seeded java.util.Random, so observed tokens recovered the state and predicted the admin reset token.

The cookie was signed over a json-parsed username but authorized over a ujson-parsed one, and a lone surrogate in a duplicate key made the two parsers disagree.

Registration passed the whole form straight into the user insert, so adding is_admin to the request created an admin account.

A Jinja2 SSTI with builtins blacklisted by name, bypassed by spelling every blocked word with hex escapes.

The flag was already sitting in the page, no request needed past the source.

A JWT that accepted the none algorithm, so an unsigned token with a tampered claim sailed through.

The download page checked nothing, so requesting the authenticated endpoint directly returned the flag.

A front proxy that did not URL-decode while the backend did, so percent-encoding the admin path walked straight past the access control. abl found it.