CyberSecBulletin

Pwndoc vulnerabilities

We track 2 vulnerabilities in Pwndoc products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 20, 2025.

2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score

Latest Pwndoc vulnerabilities

  • 8.1 High severity

    pwndoc: Cross-Site Request Forgery

    CVE-2025-23044Pwndoc

    PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to ref

  • 8.5 High severity

    pwndoc: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2024-55602Pwndoc

    PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arb