Joomla

Curling: abuse the Joomla exposure for a shell, then use local enumeration to reach root.

DevVortex: use CVE-2023-23752 where it fits the service, gain a shell, and escalate to root.