$ grep -r "path-hijacking"
A portfolio site's login form is bypassed with a SQL injection, exposing an image upload page. Weak content validation is defeated by prepending PNG magic bytes to a PHP webshell, giving code execution as www-data and a reverse shell. A database config file leaks MySQL credentials; mysqldump recovers a plaintext password that is reused to become theseus. A custom SUID binary, /bin/sysinfo, calls helper tools by relative name, so PATH hijacking a malicious lshw yields a shell as root.
An XWiki instance on a hidden vhost is vulnerable to CVE-2025-24893, an unauthenticated Groovy injection in the SolrSearch endpoint, which is used to stage and run a reverse shell as the xwiki user. XWiki's hibernate.cfg.xml leaks a database password reused for SSH as oliver. oliver belongs to the netdata group, and the SUID ndsudo helper (CVE-2024-32019) resolves its target binaries through the untrusted PATH, so a PATH hijack runs an attacker-controlled binary as root.