Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:22:17 +0000 CVE-2025-23044 — Cross-Site Request Forgery (CSRF) allows creating admin account with POST request https://cve.radiocsirt.org/vuln/cve-2025-23044 <p><strong>Affected:</strong> pwndoc</p> <p>PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user&#39;s behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.</p> <p><strong>Affected:</strong> pwndoc</p> <p>PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user&#39;s behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-23044