Cupid’s Matchmaker
Stored XSS in a matchmaking survey steals the reviewer’s session cookie and exposes the flag.
love-at-first-breach
7 posts
Corp Website
CVE-2025-55182 provides remote code execution before a permissive sudo path completes privilege escalation.
CupidBot
The bot leaks its verification code, which can be replayed to authorize disclosure of all three challenge flags.
Speed Chatting
An unrestricted profile-image upload accepts executable Python and turns a chat account into a reverse shell.
TryHeartMe
An improperly protected JWT lets a normal shopper forge an admin role and redeem the staff-only flag.
When Hearts Collide
A broken MD5-based image matcher can be defeated with a collision to force a successful match.
Love Letter Locker
An insecure direct object reference exposes another user’s private letter—and the flag—by changing its numeric ID.
