PT-2025-13031 · Unknown · Nightwolf Penetration Testing Platform

Published 2025-03-27 · Updated 2025-03-27 · CVE-2025-31165

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NightWolf Penetration Testing Platform version 1.2.2

Description The issue is related to a Cross-Site Scripting (XSS) vulnerability in the Logbug module, which allows attackers to execute JavaScript through the markdown editor feature.

Recommendations For NightWolf Penetration Testing Platform version 1.2.2, consider disabling the markdown editor feature in the Logbug module until a patch is available. Restrict access to the Logbug module to minimize the risk of exploitation. Avoid using the markdown editor feature in the affected version until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-31165

Affected Products

Nightwolf Penetration Testing Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-31165 · Security Note
• https://t.me/cvetracker/20041 · Telegram Post
• https://twitter.com/CVEnew/status/1905119037673312513 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1905124179935920534 · Twitter Post
• https://t.me/cvedetector/21253 · Telegram Post
• https://bug.report.night-wolf.io/changelogs · Note