7 points by freddyb
XSS to RCE is pretty neat. Really liked the XSS vector but slightly disappointed it required two injections :D