Jenkins

Jenkins Script Console abuse is post-authenticated access to the Groovy console. A principal with Overall/Administer can execute arbitrary Groovy on the controller or an agent, run OS commands as that service account, read accessible files, decrypt Jenkins credentials, and alter Jenkins configuration. This is an administrative capability, not an unauthenticated /credentials endpoint or standalone vulnerability.