Web

Missing input validation in the BitBake Toaster server (Yocto Project) lets a remote, unauthenticated attacker execute arbitrary OS commands via a crafted HTTP request.

The delete-testimonial endpoint in SourceCodester Testimonial Page Manager 1.0 puts the testimony argument into a SQL query unsanitized, allowing remote SQL injection without …

The add-testimonial handler in SourceCodester Testimonial Page Manager 1.0 echoes several POST fields without encoding, allowing script injection into the page.

The add-user page in SourceCodester QR Code Login System 1.0 fails to encode the qr-code argument, letting an attacker inject script that runs in a visitor browser.

The add-guest endpoint in SourceCodester Wedding Guest e-Book 1.0 does not encode the name field before displaying it, so an attacker can inject script that runs in a visitor …

A save/load API unpickled uploaded files, so a crafted pickle gave straight RCE and read the flag back through the save endpoint.

A Kahoot-style websocket quiz that leaks the scoreboard after every guess, which can be turned into an answer oracle. Analyzed but not implemented.

A length check meant for single-character input was bypassed by passing the query parameter as an array, opening a path traversal to flag.txt.

A URL-preview endpoint that fetched any address and handed back a chosen element, which made it a clean SSRF into the internal network and cloud metadata.