Web

A one-line Node server lets you inject a rel=stylesheet entry into the Link response header, which Firefox applies to the flag-bearing page, enabling CSS attribute-selector exfiltration of the cookie.

Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost.

A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.