A public API repo on a Gogs server leaks an unsanitised eval() in the brew-ABV check, and a second commit leaks the API creds needed to reach it, so a JSON field turns into RCE inside a Docker container. DB creds from settings.py dump the user table, Gilfoyle reused his password on Gogs, and the same password again decrypts an SSH key from a private repo. His .vault-token is scoped to a HashiCorp Vault root_otp SSH role, so vault ssh just hands me a one-time root password.
A DNS zone transfer leaks a preprod payroll vhost with a SQL injection that hands me file-read on the box. The nginx config points at a second vhost carrying a path-traversal LFI that leaks michael's SSH key, and a sudo-able fail2ban restart plus write access to action.d turns a ban action into a root shell.
An SSRF in a book-cover upload form leaks an internal API and dev creds; deleted-but-not-forgotten git history hands over prod creds, and a GitPython ext:: protocol bug (CVE-2022-24439) finishes the job as root.
An arbitrary file read in a bundled ImageMagick binary (CVE-2022-44268) leaks the site's SQLite database and a user's password, and a root-owned malware-scanning script running a vulnerable binwalk (CVE-2022-4510) is abused for a path-traversal write that plants a reverse shell as root.
An LFI in an image viewer leaks source and a vulnerable Spring Cloud Function dependency (CVE-2022-22963); a cron-run Ansible play then hands over root.
An exposed .git repo reveals a dev vhost; a PHP LFI plus the phar:// wrapper gives RCE, then a SUID Python app and a sudo easy_install reach root.
Stored XSS in a request header steals an admin cookie, a command injection in the admin dashboard lands a shell, and a sudo maintenance script gives root.
A PHP upload filter bypass drops a webshell, a GhostScript RCE (CVE-2023-36664) and a cracked hash move laterally, and a writable service path reaches SYSTEM.
An exposed SQLite backup leaks an admin hash, an XXE in a hidden panel exfiltrates an SSH key, and PATH hijacking on a SUID binary escalates to root.
A classic box: a vulnerable Samba username-map script (CVE-2007-2447) gives an unauthenticated root shell in a single request.
Credential reuse and mailbox enumeration expose a Moodle admin login; a Moodle spell-check RCE lands a shell, and an outdated kernel gets root.
