Lesson:
File Upload Vulnerabilities
Public previewWant everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
Train my teamDropping the URL of the "profile image" in the browser address bar causes the script to be executed.
Dropping the URL of the "profile image" in the browser address bar causes the script to be executed.

cdn.example.com/1a2fe/hack.php
What is your bidding?