Powerpopped default credentials exposed admin panel

Exposed Admin Route and Default Credentials Lead to Staff Panel Access | Powerpopped

Lab Link Powerpopped Overview Powerpopped was a WebVerse Pro daily challenge based on a small storefront with a staff back-office. The briefing hinted that the application had been built quick...

Jul 8, 2026 A07 - Authentication Failures, Default Credentials

Snobble prompt injection internal secret disclosure

Prompt Injection Leads to Internal Secret Disclosure | Snobble

Lab Link Snobble Overview Snobble was a WebVerse Pro daily challenge focused on an in-dashboard AI assistant for a transactional email platform. The assistant was designed to help users with ...

Jul 7, 2026 A02 - Security Misconfiguration, Prompt Injection

LuggageLift SQL injection internal vault secret exposure

SQL Injection Exposes Internal Vault Secret | LuggageLift

Lab Link LuggageLift Overview LuggageLift was a WebVerse Pro daily challenge built around an unclaimed baggage storefront. The public application allowed users to browse and search visible lot...

Jul 6, 2026 A05 - Injection, SQL Injection

Prototype Pollution Leads to XSS | Subtracted

Lab Link Subtracted Overview Subtracted was a WebVerse Pro challenge built around a calculator application with shareable calculation links. The application accepted calculator state through ...

Jul 5, 2026 A05 - Injection, Prototype Pollution

CatTrap race condition like counter manipulation

Race Condition Leads to Like Counter Manipulation | CatTrap

Lab Link CatTrap Overview CatTrap was a WebVerse Pro challenge built around a small cat gallery where visitors could like photos. The application claimed to enforce a simple rule: each visitor...

Jul 5, 2026 A04 - Insecure Design, Race Condition

WorldWeb blind command injection through GraphQL host checks

Blind Command Injection via GraphQL Host Checks | WorldWeb

Lab Link WorldWeb Overview WorldWeb was a WebVerse Pro challenge built around a website monitoring dashboard. The application allowed the frontend to submit a list of hosts to a GraphQL mutation...

Jul 4, 2026 A05 - Injection, Command Injection

Unsoakable parameter pollution checkout abuse

Parameter Pollution Leads to Checkout Abuse | Unsoakable

Lab Link Unsoakable Overview Unsoakable was a WebVerse Pro daily challenge based on a small e-commerce application named Riptide. The storefront allowed users to browse water blaster products,...

Jul 3, 2026 A05 - Injection, Cross-Site Scripting

HammerHopper Server-Side Template Injection

Server-Side Template Injection Leads to Arbitrary File Read | HammerHopper

Lab Link HammerHopper Overview HammerHopper was a WebVerse Pro lab focused on a vulnerable construction company contact form. The application accepted user-supplied input through the /contact ...

Jul 2, 2026 A05 - Injection, Server-Side Template Injection

Cross-Site Request Forgery Leads to Account Takeover | Crossed

Lab Link Crossed Overview Crossed was a WebVerse Pro challenge focused on a classic Cross-Site Request Forgery (CSRF) issue. The application allowed users to submit community content that would...

Jul 2, 2026 A01 - Broken Access Control, Cross-Site Request Forgery

Command Injection Leads to Remote Code Execution | TheFallen

Lab Link TheFallen Overview TheFallen presented a node control panel with a Node Diagnostics feature. The application allowed an operator to run checks such as TLS certificate lookup, WHOIS, and...

Jul 1, 2026 A05 - Injection, Command Injection