pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

pwndoc

PwnDoc PwnDoc는 침투 테스트 보고 애플리케이션으로, 발견 내용을 쉽고 간단하게 작성하고 사용자 정의 가능한 Docx 보고서를 생성할 수 있습니다. 주요 목표는 취약점과 같은 데이터를 사용자 간에 공유하여 Pwn 에 더 많은 시간을 할애하고 Doc 에 더 적은 시간을 쓰는 것입니다. 문서 설치 데이터 역할 취약점 감사 템플릿 설정 프로필 기능 다국어 지원 다중 데이터 지원 뛰어난 사용자 정의 재사용 가능한 감사 및 취약점 데이터 관리 사용자 정의 섹션 생성 취약점에 사용자 정의 필드 추가 CVSS v3 및 v4 점수를...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc 로컬 파일 포함LFI을 통해 서버에서 Node.js 코드를 원격 실행RCE할 수 있는 취약점, @yuriisanin 발견 기능 --payload-file을 사용하여 서버 측에서 실행할 사용자 지정 Node.js 코드 익스플로잇 후 정리 요구 사항 PwnDoc 인스턴스의 관리자 계정 사용법 $ ./CVE-2022-45771-Pwndoc-LFI-to-RCE.py -h CVE-2022-45771 Pwndoc-LFI-to-RCE v1.1 - by Remi GASCOU Podalirius usage:...

CVE-2022-45771

CVE-2022-45771 PwnDoc는 경로 순회path traversal와 로컬 파일 포함LFI 취약점에 모두 노출되어 있으며, 이를 통해 권한이 없는 사용자가 JWT 시크릿을 노출시키고 코드 실행을 달성할 수 있습니다. 요구 사항: 공격자는 user 역할을 가진 유효한 계정을 보유해야 합니다. 애플리케이션에 finding.vulnType 또는 finding.category 태그가 포함된 보고서 템플릿이 있어야 합니다. 세부 사항 취약점 체인은 다음 부분들로 구성됩니다: 1. 모델 및 엔드포인트 수준 모두에서...

pwndoc v1.7.0

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

CVE-2025-23044

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

EUVD-2021-18484

Malware in sbrugna...

EUVD-2022-46985

Malicious code in bioql PyPI...

EUVD-2022-46984

Malicious code in bioql PyPI...

EUVD-2024-52836

Malicious code in bioql PyPI...

EUVD-2025-6021

Malicious code in bioql PyPI...

CVE-2024-55653

PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a UnhandledPromiseRejection on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

CVE-2022-44022

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...

CVE-2021-31590

PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27413

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27413

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27413 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...