CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

CVE-2025-59833

Flag Forge CTI platform vulnerable versions 2.1.0–2.2.9 expose hints in plaintext within the GET /api/problems/:id response, revealing unreleased hints regardless of deduction. This information disclosure undermines business logic and challenge integrity. The issue is patched in version 2.3.0. Re...

CVE-2025-59827

Flag Forge CT F Platform, version 2.1.0, exposes a privilege escalation risk via /api/admin/assign-badge due to missing access control, allowing any authenticated user to self-assign high-privilege badges (e.g., Staff) and impersonate admins. The issue is mitigated by upgrading to version 2.2.0, ...

CVE-2025-57930

Cross-Site Request Forgery CSRF vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Cross Site Request Forgery.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-57929

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-20160

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required...

CVE-2025-59826

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0...

CVE-2025-59826 FlagForgeCTF Vulnerable to Unauthorized Problem Creation

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0...

CVE-2025-59826 FlagForgeCTF Vulnerable to Unauthorized Problem Creation

Flag Forge is a Capture The Flag CTF platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0...

CVE-2025-59826

Flag Forge CT F platform (CVE-2025-59826) is affected in version 2.1.0 where non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. The issue is mitigated by upgrading to version 2.2.0. Connected sources consistently describe the vuln...

CVE-2025-10548

The CleverControl employee monitoring software v11.5.1041.6 fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are...

CVE-2025-10548 Missing Certificate Validation in CleverControl Installer Allows Remote Code Execution

The CleverControl employee monitoring software v11.5.1041.6 fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are...

PT-2025-39216

Name of the Vulnerable Software and Affected Versions Flag Forge versions prior to 2.2.0 Description Flag Forge is a Capture The Flag CTF platform. Non-admin users are able to create arbitrary challenges, which could lead to the introduction of malicious, incorrect, or misleading content...

ROS-20250923-22

A vulnerability in the curl program is related to a state issue with parallel processing of multiple transactions, resulting in ignoring HSTS support. Exploitation of the vulnerability could allow an attacker acting remotely to execute a MitM attack Vulnerability in the implementation of HTTP...

WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Double the Donation versions = 2.0.0...

CVE-2025-57930

Cross-Site Request Forgery CSRF vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Cross Site Request Forgery.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-57929 WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-57929 WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-57929

CVE-2025-57929 is a Stored XSS in the WordPress plugin Double the Donation (vulnerable up to 2.0.0). Root cause: improper neutralization of input during web page generation. Impact (per sources): requires authentication; could inject scripts via input handled by the plugin. Remediation: update to...

CVE-2025-57930

CVE-2025-57930 describes a Cross-Site Request Forgery in the WordPress plugin Double the Donation (affected: 0 through 2.0.0) that requires user interaction to trigger. Impact is limited to CSRF-propagated actions authenticated as a user; CVSS 3.1 base score 4.3 (Medium). Remediation: upgrade to ...