Vulnerabilities

TI-2025-20248 CVE-2025-27413

PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

MEDIUM 64

PwnDoc is a penetration test reporting application.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.01179 Published 2025-02-28 Fixed in 1.2.0 CWE-22

TI-2025-20245 CVE-2025-27410

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

MEDIUM 64

PwnDoc is a penetration test reporting application.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.02111 Published 2025-02-28 Fixed in 1.2.0 CWE-22

TI-2025-16853 CVE-2025-23044

Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

HIGH 70

PwnDoc is a penetration test report generator.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00251 Published 2025-01-20 Fixed in 14acb70 CWE-352

TI-2024-36932 CVE-2024-55652

PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

MEDIUM 64

PenDoc is a penetration testing reporting application.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00672 Published 2024-12-11 Fixed in 1d4219c CWE-1336

TI-2024-36933 CVE-2024-55653

pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)

MEDIUM 62

PwnDoc is a penetration test report generator.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00619 Published 2024-12-10 No fix listed CWE-20

TI-2024-36911 CVE-2024-55602

PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal

HIGH 70

PwnDoc is a penetration test report generator.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00692 Published 2024-12-10 Fixed in 1d4219c CWE-22

TI-2022-22589 CVE-2022-45771 · GHSA-7588-p92j-p3hh

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate…

HIGH 73

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01936 Published 2022-12-05 No fix listed CWE-434

TI-2022-21648 CVE-2022-44023 · GHSA-prxc-h72j-qg6j

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names…

MEDIUM 63

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.009 Published 2022-10-29 No fix listed CWE-307

TI-2022-21647 CVE-2022-44022 · GHSA-rxj6-c9ph-rrrh

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by…

MEDIUM 63

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.009 Published 2022-10-29 No fix listed CWE-307

TI-2021-11696 CVE-2021-31590 · GHSA-w9w2-pj3m-5v3r

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling…

MEDIUM 43

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02653 Published 2021-07-19 No fix listed

Vulnerabilities

Filters