CVE-2025-23044

8.1 highEPSS 0.3%

High (8.1) in pwndoc project pwndoc. EPSS 0.3% chance of exploitation in the next 30 days.

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2025-01-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pwndoc_project:pwndoc

References

https://github.com/pwndoc/pwndoc/commit/14acb704891245bf1703ce6296d62112e85aa995
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rq

Check your stack JSON