Archives

Exploiting path traversal in file uploads to achieve arbitrary file write and remote code execution by overwriting system binaries.

Python sandbox escape through function reassignment to bypass whitelist restrictions and read the flag file.

Exploiting XSS and CORS misconfiguration to change admin password and gain unauthorized access through admin bot interaction.

Exploiting a Next.js application through CSS injection to extract Next-Action headers and bypass CSRF protection.

Exploiting boolean SQL injection to leak admin directory path, then using Git command injection to read flag from previous commits.