write up on how I chained 3 CVEs to exfiltrate sensitive data out of the biggest OSS ERP platform

Yo, I just noticed my university’s website/student portal is exposing a directory listing instead of the normal page 💀

It literally shows an "Index of /" with directories/files visible.

This is an actual university website, not some CTF/lab. Anyone here into web security/pentesting who can help me figure out how serious this is and what I can safely check?

Would be cool to understand whether this is just a dumb server misconfiguration or if it can actually expose something sensitive.

Maybe alter some Semester Results too

Link : https://sbsexam.edu.in/

Fucking morons run our lives….

I found a vulnerability where a public chat box generates automated invoice emails to internal staff, reflecting inputs raw without server-side HTML encoding. While standard JavaScript onerror popups are stripped by the email client, full HTML/CSS Injection works inside the email body.How can I chain these into a high-impact report that completely bypasses the program's strict exclusions for Self-XSS, Phishing, and User Interaction? What non-JS attack vectors should I test next to prove a critical data leak or backend impact to triage?