PT-2026-41168

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.3 Description An issue exists where the audio transcription upload endpoint uses the file extension from a user-supplied filename to save files. The '/cache/path' route serves these files via FileResponse, whic...

CVE-2026-42298

CVE-2026-42298 affects Postiz (AI social media scheduling tool). The issue arises in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml), where an unauthenticated user can cause arbitrary code execution during Docker image build by submitting a fork with a malic...

Gitroom Postiz 代码注入漏洞

Gitroom Postiz is an open-source social media scheduling tool developed by Gitroom. Previous versions of Gitroom Postiz had a code injection vulnerability. This vulnerability stemmed from a Pwn Request vulnerability present in the workflow for building and publishing PR Docker images, which could...

MAL-2026-3248 Malicious code in pwn-control (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 719b4c85917a0a8bc84e7591598b0d17098dd32c8f29b5c09eb25fe1d3e079c3 During installation, the code runs code to silently control the device via Telegram bot execute commands, exfiltrate files. --- Category: MALICIOUS - The...

CVE-2026-25117 pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/ routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http://dojo.website. This is a sandbox...

EUVD-2026-4941

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/ routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http://dojo.website. This is a sandbox...

CVE-2026-25117 pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/ routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http://dojo.website. This is a sandbox...

DOJO Cross-Site Scripting Vulnerabilities

DOJO is a JavaScript toolkit open source by pwn.college. pwn.college’s DOJO has a cross-site scripting vulnerability; this vulnerability stems from the lack of sandbox isolation, which may lead to sandbox escape and arbitrary JavaScript execution...

EUVD-2025-200940

Malicious code in elf-stats-cocoa-train-606-pwn npm...

MAL-2025-192011 Malicious code in elf-stats-cocoa-train-606-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4a2ad86066923fe6379934132398fbb6f3287faed48a48d33fff55bde7a745 The package elf-stats-cocoa-train-606-pwn was found to contain malicious code...

Exploit for CVE-2025-62376

Improper Authentication in pwn.college DOJO Education Platform...

Pwn2Own Ireland 2025: The Hacks, The Winners, and The Big Payouts

Hackers earned over $1 million at Pwn2Own Ireland 2025 in Cork, breaching printers, routers, NAS devices, and more as Summoning Team claimed Master of Pwn...

Exploit for CVE-2025-62376

CVE-2025-62376: Local Privilege Escalation Exploit for Sudo...

EUVD-2022-51701

Malicious code in bioql PyPI...

CVE-2022-4349

A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The...

PwnDoc 路径遍历漏洞

PwnDoc is a penetration test report generator from the PwnDoc open source. A path traversal vulnerability exists in PwnDoc versions prior to 1.2.0, which stems from the backup recovery feature allowing the import of raw data containing path traversals, which could lead to remote code execution...

CVE-2025-24885

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom unprivileged dojo pages causes ability for users to create stored XSS...

CVE-2025-24886 pwn.college has Symlink LFI in Dojo repos

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users admin not required to perform an LFI from the CTFd container. When a user clones or updates repositories, a check...

PT-2025-5592 · Unknown · Pwn.College

Name of the Vulnerable Software and Affected Versions: pwn.college affected versions not specified Description: The issue is related to a lack of access control when generating custom Dojo pages without privileges, allowing users to create stored XSS. This affects the pwn.college platform, which ...

PT-2024-9874 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: PwnDoc versions up to and including 0.5.3 Description: The issue is related to insufficient input validation in the audits interface of the PwnDoc tool, which can be exploited by an authenticated user to crash the backend by raising an...