Vulnerabilities

TI-2026-19733 CVE-2026-24479

HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE

MEDIUM 59

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.08133 Published 2026-01-27 Fixed in 26.01.24 CWE-22

TI-2026-19231 CVE-2026-23873

MEDIUM 57

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training.

CVSS 4.0MEDIUM 5.2 Network Low privileges User interaction EPSS 0.00569 Published 2026-01-21 No fix listed CWE-1236

TI-2025-32272 CVE-2025-50938 · GHSA-7p4h-q4v9-7qf9

MEDIUM 60

Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00241 Published 2025-08-19 No fix listed CWE-79

TI-2022-20442 CVE-2022-42187 · GHSA-6x38-jqg6-xx78

MEDIUM 60

Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00445 Published 2022-11-17 No fix listed CWE-79