Doctor Appointment 1
SQLi auth-bypass in a healthcare login. Send the injection to the API and read the full JSON response - it leaks the username, password and flag.
$ Web
Massagold
Stored XSS via unescaped EJS output, CSP bypassed using a Google JSONP endpoint, payload delivered to an admin bot that exfiltrated the flag from the admin inbox back to us.
Gatery
An Elysia backend's signed session cookie fails to verify signatures (CVE-2025-66457), letting a forged session=inside cookie bypass auth.