Beach Bar
Leaked credentials lead to unsafe YAML deserialization, remote code execution, and Linux privilege escalation.
byte-lotus
7 posts
Do Not Disturb
A NoSQL authentication bypass opens an EJS SSTI path, followed by debugger hijacking and privilege escalation.
Hollow Shell
Default credentials and a Zip Slip upload escape the theme directory and turn an automation hook into code execution.
Infinity Pool
Command injection in a legacy network-check endpoint leads through internal services to full compromise.
Room 404
An exposed .git directory leaks the staging source and a flag left in the repository.
The Guestbook
Prompt injection against an AI concierge reveals hidden directives and bypasses output redaction.
Towel on the Sunbed
A race condition lets parallel reward claims bypass the 24-hour lock and open the Whale Vault.
