Web

Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost.

Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.

A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.