CVE-2025-23044mediumCWE-352

CVE-2025-23044: fallo de gravedad media en pwndoc

Cross-Site Request Forgery (CSRF) allows creating admin account with POST request

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pwndoc

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.8epss 0.3%
PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Productos afectados
pwndoc · pwndoc
CVEs relacionadas — pwndoc

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-27410MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as adminEPSS 2.1%CVE-2025-27413MEDIUMPwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.jsonEPSS 1.2%CVE-2024-55602HIGHPenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path TraversalEPSS 0.7%CVE-2024-55652MEDIUMPwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filtersEPSS 0.7%CVE-2024-55653MEDIUMpwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)EPSS 0.6%