Broken Access Control Leads to Account Takeover | Granted

Lab Link Granted Overview Granted is a workspace management application containing an Operations Assistant that can look up accounts and reset passwords. The application correctly displayed the...

Jul 18, 2026 A01 Broken Access Control, Authorization

Weak OTP Verification Leads to Account Takeover | Comical

Lab Link Comical Overview Comical was a members-only comic storefront protected by a username and password followed by a three-digit verification code. Public content on the application disclos...

Jul 17, 2026 A07 - Authentication Failures, Weak OTP

Shelled command injection challenge cover

Prompt Injection Leads to Command Execution | Shelled

Lab Link Shelled Overview Shelled is a WebVerse Pro mystery challenge built around an AI-assisted command runner. The application accepts a natural-language query, converts it into a shell comma...

Jul 16, 2026 A05:2025 - Injection, Command Injection

Statica prompt injection and secret masking bypass

Prompt Injection Leads to Secret Disclosure | Statica

Lab Link Statica Overview Statica is a deployment dashboard containing an AI assistant that can answer questions about a frontend project’s deployments, domains, build settings, and environment ...

Jul 14, 2026 A02 - Security Misconfiguration, Prompt Injection

Packed exposed Git repository and header-based admin bypass

Exposed Git Repository Leads to Header-Based Admin Bypass | Packed

Lab Link Packed Overview Packed was a WebVerse Pro challenge built around a small Express-based arcade game application. At first glance, the application looked like a simple Chomp/Pac-Man st...

Jul 13, 2026 A02 - Security Misconfiguration, Information Disclosure

CarCloppin SQL Injection challenge cover

SQL Injection Exposes API Credentials | CarCloppin

Lab Link CarCloppin Overview CarCloppin was a dealership booking application that included an AI-powered assistant named Riley. The assistant allowed users to look up vehicle appointments by ent...

Jul 12, 2026 A05 - Injection, SQL Injection

Hookery JWT algorithm confusion leading to platform administrator access

JWT Algorithm Confusion Leads to Platform Admin Access | Hookery

Lab Link Hookery Overview Hookery was a WebVerse Pro mystery challenge built around a webhook service and a protected platform console. The application used JSON Web Tokens for authentication...

Jul 12, 2026 A07 - Authentication Failures, JWT

Path Traversal Leads to Arbitrary File Read | Ohmly

Lab Link Ohmly Overview Ohmly was a WebVerse Pro mystery challenge built around a small electronics component catalog. Each product page included a downloadable PDF datasheet, and the applicat...

Jul 11, 2026 A01 - Broken Access Control, Path Traversal

XXE Leads to Local File Disclosure | Chainline

Lab Link Chainline Overview Chainline was a WebVerse Pro challenge based on a cycling tracker application that allowed users to import ride data using GPX files. The challenge briefing hinted...

Jul 9, 2026 A05 - Injection, XML External Entity

Ligature client-side price tampering checkout bypass

Client-Side Price Tampering Leads to Unauthorized Purchase | Ligature

Lab Link Ligature Overview Ligature was a WebVerse Pro daily challenge based on a small digital font storefront. The application listed multiple font products and allowed users to add items to...

Jul 9, 2026 A04 - Insecure Design, Business Logic