PT-2025-5592 · Unknown · Pwn.College

Cjreed121 · Published 2025-01-30 · Updated 2025-01-31 · CVE-2025-24885

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions pwn.college (affected versions not specified)

Description The issue is related to a lack of access control when generating custom Dojo pages without privileges, allowing users to create stored XSS. This affects the pwn.college platform, which is an education platform for learning and practicing core cybersecurity concepts in a hands-on manner.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

XSS

Weakness Enumeration

CWE-284

CWE-79

Related Identifiers

CVE-2025-24885

GHSA-8M79-RMHW-RG84

Affected Products

Pwn.College

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24885 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24885 · Vendor Advisory
• https://github.com/pwncollege/dojo/security/advisories/GHSA-8m79-rmhw-rg84 · Note
• https://t.me/cvenotify/109330 · Telegram Post
• https://t.me/cvedetector/16863 · Telegram Post
• https://twitter.com/CVEnew/status/1885098266590921162 · Twitter Post