HieuPenguinnn Blog
Home CVE Write-up About
Home
CVE
Write-up
About
Type a keyword to search posts
HieuPenguinnn

HieuPenguinnn

CVE & CTF writeups by HieuPenguinnn

41
Posts
10
CVE
31
CTF

Categories

├── CVE (10) │ ├── Broken Access Control (6) │ ├── Information Disclosure (2) │ ├── IDOR (2) │ ├── Webhook Forgery (2) │ ├── SQL Injection (1) │ ├── Payment Bypass (1) │ ├── Stored XSS (1) │ ├── Price Tampering (1) │ └── Account Takeover (1) └── CTF (31) ├── GPNCTF 2026 (8) ├── PTITCTF Quals 2026 (7) ├── TJCTF 2026 (6) ├── UMassCTF 2026 (3) ├── UTCTF 2026 (3) ├── OmniCTF 2026 (2) └── SekaiCTF 2026 (2)

Random Picks

GPNCTF2026-Secure Secretpickle UMassCTF2026-ORDER66 CVE-2026-78259 - WPLegalPages API Secret Disclosure and Account Disconnect via Unauthenticated REST API CVE-2026-57365 - Stored XSS in reCAPTCHA for Asgaros Forum via Site Key UTCTF2026-Break the Bank

Tag: RCE (2 posts)

P
PTITCTF Quals 2026

Palworld Mod

Path traversal in the mod build flow writes a Python codec payload and reaches server-side code execution.

Read
CTF Web Path Traversal RCE PTITCTF
P
PTITCTF Quals 2026

PTIT Portfolio Renderer

Jinja2 SSTI bypasses a blacklist, reaches RCE, and reads the challenge flag.

Read
CTF Web SSTI RCE PTITCTF
HieuPenguinnn

HieuPenguinnn

CVE & CTF writeups by HieuPenguinnn

41
Posts
10
CVE
31
CTF

Categories

├── CVE (10) │ ├── Broken Access Control (6) │ ├── Information Disclosure (2) │ ├── IDOR (2) │ ├── Webhook Forgery (2) │ ├── SQL Injection (1) │ ├── Payment Bypass (1) │ ├── Stored XSS (1) │ ├── Price Tampering (1) │ └── Account Takeover (1) └── CTF (31) ├── GPNCTF 2026 (8) ├── PTITCTF Quals 2026 (7) ├── TJCTF 2026 (6) ├── UMassCTF 2026 (3) ├── UTCTF 2026 (3) ├── OmniCTF 2026 (2) └── SekaiCTF 2026 (2)

Random Picks

SekaiCTF2026-web_<_w+ OmniCTF2026-web/Ganzir GPNCTF2026-cookoff UMassCTF2026-BrOWSER BOSS FIGHT UTCTF2026-Crab Mentality
10 CVE 31 CTF writeups 41 posts
© 2026 HieuPenguinnn | Powered by Astro & Tailwind | Theme by santisify
Home CVE Write-up About