Rce

CachedWeb: chain SSRF with path control to reach the internal target and read the flag.

Amidst Us: find the command execution path, trigger it cleanly, and read the flag.

Letter Dispair: find the command execution path, trigger it cleanly, and read the flag.

C.O.P: exploit the SQL injection, extract the needed data, and reach the flag.

Toxic: abuse unsafe deserialization to cross the trust boundary and reach the flag.