İçerik Üretimi

Harden a vulnerable ComfyUI against an arbitrary command execution flaw (CVE-2026-68771) to capture the flag.

İncele →

Harden a vulnerable JellyStat against a SQL injection flaw (CVE-2026-41167) that lets attackers run arbitrary queries on the SQL server, to capture the flag.

İncele →

Harden a vulnerable Apache Kyuubi SQL gateway against an arbitrary file write flaw (CVE-2026-52680) to capture the flag.

İncele →

Harden a vulnerable fluentd log aggregator against an arbitrary file write flaw (CVE-2026-44024) to capture the flag.

İncele →

Harden a vulnerable Kotaemon LLM QA system against an arbitrary command execution flaw (CVE-2026-69098) to capture the flag.

İncele →

Harden a vulnerable Perspective-dev analytics platform against an arbitrary command execution flaw (CVE-2026-67195) to capture the flag.

İncele →

Unauthenticated PolarsVirtualServer expression flaw in a FINOS Perspective telemetry server: drive the WebSocket protobuf interface to escape restricted built-ins in Python eval() and gain root on the host.

İncele →

Unauthenticated batch upload in Apache Kyuubi allows path traversal and arbitrary-directory file writes; turn that constrained primitive into root code execution through a privileged service context.

İncele →

Insufficient token validation in Apache Airflow's FAB OAuth flow grants unauthorized administrative access; abuse the API and DAGs for command execution on an over-privileged orchestration service.

İncele →

Harden an application using a vulnerable Twig version against a sandbox escape (CVE-2026-46633) that allows command execution, to capture the flag.

İncele →

Pre-auth RCE in the Feast feature store registry: enumerate the gRPC service through reflection and exploit insecure deserialization in the ApplyFeatureView RPC to run commands as root.

İncele →

Unauthenticated command injection in GPT-SoVITS: enumerate the exposed Gradio API and abuse the open_asr helper's unsanitized audio output path to execute commands as root.

İncele →

Sandboxed SSTI in Twig 3.25.0: abuse the {% use %} tag compilation flaw to inject PHP through a crafted template name; the root-owned built-in PHP server turns it straight into root-level command execution.

İncele →

Chain CVE-2026-53595 and CVE-2026-53593 for unauthenticated RCE on FreeScout: take over an administrator account, then upload a .pht web shell to execute commands as the web server.

İncele →

Chain multiple flaws in an exposed Crawl4AI deployment: CVE-2026-57571 places a controlled payload on the target, then CVE-2026-57572 turns Chromium argument injection into remote code execution as root.

İncele →

Recover Metabase admin credentials from an exposed Git repository, then abuse CVE-2026-59827 native SQL against the default H2 sample database for arbitrary file write and host-root code execution.

İncele →

Unauthenticated path traversal in a Cockpit CMS instance served by PHP's built-in web server; arbitrary file read exposes the root user's SSH private key for direct administrative access.

İncele →

Command injection in Dokku's app.json managed cron: harvest credentials from a public Git repository, authenticate to the Dokku CLI, then escape the container for host-level remote code execution.

İncele →

Symlink injection in Portainer 2.33.7: recover low-privileged credentials from a leaked Git repository, abuse Git-backed stack deployment to plant a malicious symlink, then read privileged SSH keys for admin access.

İncele →

Abuse a vulnerable Gotenberg PDF service (CVE-2026-40281) to inject ExifTool arguments and drop a web shell for RCE, then root via an insecure PHP-FPM config.

İncele →

Harden a vulnerable Beszel against a path traversal flaw (CVE-2026-27734) that exposes container configs, to capture the flag.

İncele →

Harden a vulnerable AdGuard against an authentication bypass (CVE-2026-32136) to capture the flag.

İncele →

Path traversal in a Beszel monitoring deployment: abuse the hub-to-agent proxy for Docker inspect data, recover credentials from container metadata, then escalate via dangerous Docker group membership.

İncele →

Critical h2c auth bypass in AdGuard Home exposes admin APIs over HTTP/2; recover credentials hidden in filtering rules, then escalate to root via a misconfigured sudo wget rule (GTFOBins).

İncele →

Harden a vulnerable OpenEMR against an arbitrary file write flaw (CVE-2026-24848) to capture the flag.

İncele →

Server-side template injection in a Spring Boot / Thymeleaf app: bypass an incomplete CVE-2026-40478 mitigation with a whitespace parsing trick for RCE, then root via an insecure service config.

İncele →

Compromise an AVideo 26.0 deployment through its CloneSite plugin: unauthenticated information disclosure and exposed database data, custom password-hash analysis, then command injection for RCE as the web service account.

İncele →

Config leak on an exposed OpenEMR, then RCE via an authenticated arbitrary file write in the EtherFax module, escalating through a backup process vulnerable to tar wildcard injection.

İncele →

SSTI foothold for arbitrary code execution and local file read, then privilege escalation via a Directory Traversal flaw (CVE-2024-8352) in the Social Web Suite plugin for root.

İncele →

Exploit CVE-2023-26469 for a foothold, then escalate privileges by abusing misconfigured SUDO permissions.

İncele →

Web enumeration and exploitation combined with MySQL enumeration, followed by hands-on privilege escalation practice.

İncele →

Command injection in CyberPanel 2.3.7: tamper the phpSelection field in intercepted requests to run commands as root and land a reverse shell for the root flag.

İncele →