boroGPT
Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE.
Jinja2
No writeups match your filter.
La Casa de Papel (Secure Comms) — Zer0d4yh31st CTF
A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.