Python

Looks like SQL injection, but it’s really Python eval() code execution through a SQLAlchemy relationship’s order_by.

Abusing Python’s floating point arithmetic to forge JWT-like tokens — when float(‘inf’) meets type juggling.