pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

pwndoc

PwnDoc PwnDoc es una aplicación de informes de pruebas de penetración que hace simple y fácil escribir tus hallazgos y generar un informe Docx personalizable. El objetivo principal es tener más tiempo para Pwn y menos tiempo para Doc al mutualizar datos como vulnerabilidades entre usuarios...

CVE-2022-45771

CVE-2022-45771 El PwnDoc es vulnerable tanto a path traversal como a inclusión local de archivos LFI, lo que permite a usuarios no privilegiados revelar secretos JWT y lograr ejecución de código. Requisitos: Un atacante tiene una cuenta válida con el rol user La aplicación tiene una plantilla de...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Inclusión de archivo local de Pwndoc a ejecución remota de código Node.js en el servidor, descubierto por @yuriisanin Características Código Node.js personalizado para ejecutar del lado del servidor usando --payload-file Limpieza después del exploit Requisitos Una cuenta de administrador en la...

pwndoc v1.7.0

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

CVE-2025-23044

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit...

EUVD-2021-18484

Malware in sbrugna...

EUVD-2022-46984

Malicious code in bioql PyPI...

EUVD-2022-46985

Malicious code in bioql PyPI...

EUVD-2024-52836

Malicious code in bioql PyPI...

EUVD-2025-6021

Malicious code in bioql PyPI...

CVE-2024-55653

PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a UnhandledPromiseRejection on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

CVE-2022-44022

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...

CVE-2021-31590

PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27413

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27413

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...

CVE-2025-27410

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included .js file and restarting the...

CVE-2025-27413 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal ../ sequences. This is problematic for the template update functionality as it uses the path from the...