> #RCE

Blind PostgreSQL SQL injection reaches command execution through COPY TO PROGRAM.

Path traversal in the mod build flow writes a Python codec payload and reaches server-side code execution.

Jinja2 SSTI bypasses a blacklist, reaches RCE, and reads the challenge flag.