$ grep -r "password-reuse"
A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.
A publishing web app lets us preview a book cover from a URL, giving a blind SSRF that we use to port-scan localhost and reach an internal API on port 5000. One of its endpoints leaks dev credentials for SSH. In dev's home a Git repo's history exposes a second set of credentials for the prod user. prod may run a GitPython clone script as root; GitPython 3.1.29 is vulnerable to CVE-2022-24439, an ext:: URL RCE, used to run a reverse shell as root.
An XWiki instance on a hidden vhost is vulnerable to CVE-2025-24893, an unauthenticated Groovy injection in the SolrSearch endpoint, which is used to stage and run a reverse shell as the xwiki user. XWiki's hibernate.cfg.xml leaks a database password reused for SSH as oliver. oliver belongs to the netdata group, and the SUID ndsudo helper (CVE-2024-32019) resolves its target binaries through the untrusted PATH, so a PATH hijack runs an attacker-controlled binary as root.
An exposed .git directory on a dev vhost is dumped to recover a Ghost CMS admin password from a committed change. Ghost 5.58.0 is vulnerable to CVE-2023-40028, an authenticated symlink arbitrary file read, used to read the Ghost config and recover bob's SSH password. bob may run a symlink-cleaning script as root that reads a file after a vulnerable check; a TOCTOU race swaps the symlink target to root's SSH key, leaking it for a root login.
A blog's password-reset form is vulnerable to SQL injection, which dumps and cracks the admin bcrypt hash. The admin panel runs a vulnerable Laravel-admin (CVE-2023-24249) whose avatar upload is bypassed by tampering the multipart filename in Burp to land a PHP webshell, giving a shell as dash. A reused password in dash's .monitrc grants SSH as xander, who can run a custom root binary that invokes 7-Zip with an unquoted wildcard; a crafted @-listfile symlink leaks root's private SSH key.
A Dolibarr CRM on a hidden vhost runs on default admin credentials and is vulnerable to authenticated PHP code injection (CVE-2023-30253), giving a shell as www-data. Its config file leaks database credentials reused for SSH as larissa. A SUID enlightenment binary is vulnerable to CVE-2022-37706, which is abused for a root shell.
A Request Tracker instance uses default admin credentials, and a user's comment leaks the lnorgaard SSH password. A KeePass database dump is cracked with CVE-2023-32784 to recover the master password, and the vault yields root's PuTTY private key, which is converted to an OpenSSH key for a root shell.
An exposed .git directory leaks the Backdrop CMS database password, which logs us into the admin panel. An authenticated module-upload flaw gives RCE as www-data, the leaked password is reused for SSH as johncusack, and a sudo-allowed bee command evaluates PHP as root.