Writeups

CVE-2019-9053 (CMS Made Simple <=2.2.9 unauth SQLi) → staff-group PATH hijack of run-parts

GraphQL-leaked creds + HelpDeskZ arbitrary file upload → kernel exploit (CVE-2017-16995) to root

SQLi auth bypass → SSTI RCE → bind-mount container escape to host root

secret.txt-leaked Joomla creds → template-edit RCE → curl -K config injection via a root cron job

Ruby regex per-line-anchor bypass → SSTI (RCE as susan) → cracked password from a leaked hash + mail hint

XSS via User-Agent header, admin's headless-browser bot → relative-path script hijack

Joomla unauth info disclosure (CVE-2023-23752) → admin template-editor RCE → apport-cli sudo (CVE-2023-1326)

Log4Shell (CVE-2021-44228) via Minecraft chat → RCON password reused as local Administrator password

CVE-2023-30547 (vm2 sandbox escape, <=3.9.16) → svc → joshua → root

CVE-2023-46604 (ActiveMQ OpenWire RCE) → GTFOBins nginx sudo rule → arbitrary root-owned file read

CVE-2023-51467 (OFBiz auth bypass) + Groovy RCE → cracked OFBiz admin hash, reused as root's password

Metabase pre-auth RCE (CVE-2023-38646) via H2 JDBC injection → env-leaked SSH creds → GameOver(lay) kernel privesc

pdfminer.six CMap pickle RCE (CVE-2025-64512) → LFI pivot to an internal service → MONAI checkpoint pickle RCE to root