Web

A SQL injection in an invoice search dumped a user table, the password doubled as an SSH login, and a sudo awk entry handed over root.

A client-side filter was the only thing guarding command execution. Past it was a file read to SSH keys, then a SUID gawk for root.

A Gradio app on the usual port 7860, vulnerable to the path-traversal file read that let us pull /flag.txt.

A directory brute force found a transfer endpoint with a password-protected zip. Cracking it gave a CSV whose four encoded passwords were each their own mini challenge.

A REST API endpoint in Cisco Nexus Dashboard and NDFC lets an authenticated, low-privileged attacker view sensitive information and modify certain files.

A REST API endpoint in Cisco Nexus Dashboard and NDFC discloses sensitive information to an authenticated, low-privileged attacker through its responses.

A length-restricted XSS behind a brutal CSP. Multiline JS comments stitched several short injections into one script, which poisoned the admin bot notes, navigated it to where the …

A cpio archive extraction allowed path traversal, which overwrote a user record to grant admin, and the admin page printed the flag.

A GraphQL endpoint with introspection turned off still answered a guessed query field that returned the flag.

Open WebUI 0.3.0 does not validate the content type or filename on its audio transcription endpoint, letting an authenticated user write a file to a path of their choosing.