Pwncollege vulnerabilities
We track 4 vulnerabilities in Pwncollege products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on January 29, 2026.
Latest Pwncollege vulnerabilities
- 8.3 High severity
pwn.college DOJO is an education platform for learning cybersecurity.
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as
- 9.5 Critical severity
dojo: Improper Authentication
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contains an improper authentication vulnerability that allows an attacker to access any active Windows VM wi
- 7.7 High severity
dojo: UNIX Symbolic Link (Symlink) Following
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user
- 7.6 High severity
dojo: Improper Neutralization of Input During Web Page Generation
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.