Vulnerabilities in CTFd
3 resultsCVE-2024-11716MEDIUMWhile assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation alEPSS 11.6%CVE-2024-11717MEDIUMTokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sentEPSS 0.7%CVE-2026-121562MEDIUMCTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams EndpointEPSS 0.3%