Web

TL;DR: Exfiltration through XS Leak via server-side redirects detection

TL;DR: RCE through polluting node execSync options and algorithm confusion

TL;DR: XSS via HTML entity double-parse and CSP bypass via PHP warning

TL;DR: SSRF by bypassing the https:// scheme filter through an XML parsing discrepancy

TL;DR: RCE via data: URI injection in import() and node permission bypass via inspector API

TL;DR: XSS via path traversal chained with arbitrary file write through PHP session upload progress

TL;DR: Stored XSS bypassing the CSP via a raw HTTP response endpoint, chained with a meta-refresh redirect to hijack the admin bot

TL;DR: X-Admin-Key leak via TRACE method and SSRF through ESI injection