PP
Vendor
Pwndoc Project
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-27413 | PW Pwndoc Pwndoc Project | 4.9 | Feb 28 | PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json |
| CVE-2025-27410 | PW Pwndoc Pwndoc Project | 6.5 | Feb 28 | PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin |
| CVE-2025-23044 | PW Pwndoc Pwndoc Project | 8.1 | Jan 20 | Cross-Site Request Forgery (CSRF) allows creating admin account with POST request |
| CVE-2024-55653 | PW Pwndoc Pwndoc Project | 6.5 | Dec 10 | pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS) |
| CVE-2024-55602 | PW Pwndoc Pwndoc Project | 8.5 | Dec 10 | PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal |
| CVE-2022-45771 | PW Pwndoc Pwndoc Project | 8.8 | Dec 5 | An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file |
| CVE-2022-44023 | PW Pwndoc Pwndoc Project | 5.3 | Oct 29 | PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts |
| CVE-2022-44022 | PW Pwndoc Pwndoc Project | 5.3 | Oct 29 | PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts |
| CVE-2021-31590 | PW Pwndoc Pwndoc Project | 8.8 | Jul 19 | PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control |