CVE-2025-23044

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
pwndoc	pwndoc	< 14acb704891245bf1703ce6296d62112e85aa995

References

https://github.com/pwndoc/pwndoc/commit/14acb704891245bf1703ce6296d62112e85aa995Patch
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rqExploit, Vendor Advisory

Timeline

Published: Jan 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-230459.8Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on CVE-2025-230467.5GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authent CVE-2025-230476.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin`CVE-2025-230489.1In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using CVE-2025-230498.4Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.CVE-2025-23058.6A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to downloa CVE-2025-230503.1QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero).CVE-2025-230517.2An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. S CVE-2025-230527.2Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this CVE-2025-230536.5A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploi CVE-2025-230546.5A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege ope CVE-2025-230555.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond