Hollow Shell
Default credentials and a Zip Slip upload escape the theme directory and turn an automation hook into code execution.
file-upload
2 posts
Speed Chatting
An unrestricted profile-image upload accepts executable Python and turns a chat account into a reverse shell.
