Pwndoc is a penetration-testing and security-assessment documentation platform whose narrow product scope places it among more prominent niche tools in the vulnerability landscape. Its recurring exposure centers on path traversal, excessive authentication attempts, input validation, and cross-site request forgery, reflecting the web application interface and user-input handling typical of documentation and reporting tools used by security teams. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pwndoc Project over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-45771HIGH An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. | Dec 5, 2022 | 8.8 | 29 | NO | NO |
CVE-2021-31590HIGH PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication a | Jul 19, 2021 | 8.8 | 28 | NO | NO |
CVE-2025-27410MEDIUM PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an at | Feb 28, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-23044HIGH PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST r | Jan 20, 2025 | 8.1 | 22 | NO | NO |
CVE-2024-55602HIGH PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inje | Dec 10, 2024 | 8.5 | 22 | NO | NO |
CVE-2022-44023MEDIUM PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. | Oct 30, 2022 | 5.3 | 21 | NO | NO |
CVE-2022-44022MEDIUM PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts. | Oct 30, 2022 | 5.3 | 21 | NO | NO |
CVE-2025-27413MEDIUM PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including | Feb 28, 2025 | 4.9 | 18 | NO | NO |
CVE-2024-55653MEDIUM PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on | Dec 10, 2024 | 6.5 | 18 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pwndoc Project.
Media articles that mention a CVE ID that affects a product developed by Pwndoc Project — matched by CVE ID, not by vendor name.