Pwndoc Project
Pwndoc Project Pwndoc: vulnerabilidades y CVE
Pwndoc Project Pwndoc tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-27413 | Media (4.9) | 1.2% | — | 28 feb 2025 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This… |
| CVE-2025-27410 | Media (6.5) | 2.1% | — | 28 feb 2025 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the… |
| CVE-2025-23044 | Alta (8.1) | 0.25% | — | 20 ene 2025 | PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite=… |
| CVE-2024-55653 | Media (6.5) | 0.62% | — | 10 dic 2024 | PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The… |
| CVE-2024-55602 | Alta (8.5) | 0.69% | — | 10 dic 2024 | PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences… |
| CVE-2022-45771 | Alta (8.8) | 1.8% | — | 5 dic 2022 | An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. |
| CVE-2022-44023 | Media (5.3) | 0.78% | — | 30 oct 2022 | PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. |
| CVE-2022-44022 | Media (5.3) | 0.78% | — | 30 oct 2022 | PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts. |
| CVE-2021-31590 | Alta (8.8) | 2.7% | — | 19 jul 2021 | PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.