Rce

SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app.

A PHP upload app re-encodes every GIF through PHP-GD as sanitization but never validates the filename — a payload smuggled inside the GIF color palette survives the re-encode, yielding a GIF/PHP polyglot webshell and RCE.

A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.

A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password.

Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag.

A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.

Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.