Medium severity6.8NVD Advisory· Published Jan 20, 2025· Updated Jun 17, 2026

CVE-2025-23044

Description

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pwncollege/Pwndocv52 versions
< 14acb704891245bf1703ce6296d62112e85aa995+ 1 more
- (no CPE)range: < 14acb704891245bf1703ce6296d62112e85aa995
- (no CPE)
Pwndoc Project/Pwndoc
cpe:2.3:a:pwndoc_project:pwndoc:*:*:*:*:*:*:*:*
Range: <0.9.0

Patches

Vulnerability mechanics

References

github.com/pwndoc/pwndoc/commit/14acb704891245bf1703ce6296d62112e85aa995nvdPatch
github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rqnvdExploitVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000