PortSwigger Web Security Academy: identifying FreeMarker from a verbose error and reading its own documentation to reach remote code execution.

PortSwigger Web Security Academy: basic server-side template injection in an ERB message parameter, escalated to command execution.