CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 3CVE-2022-45771
https://notcve.org/view.php?id=CVE-2022-45771
05 Dec 2022 — An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. • https://github.com/p0dalirius/CVE-2022-45771-Pwndoc-LFI-to-RCE •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-44022
https://notcve.org/view.php?id=CVE-2022-44022
29 Oct 2022 — PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts. PwnDoc hasta 0.5.3 podría permitir a atacantes remotos identificar nombres de cuentas de usuario válidos aprovechando los tiempos de respuesta para los intentos de autenticación. • https://cve.nstsec.com/cve-2022-44022 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-44023
https://notcve.org/view.php?id=CVE-2022-44023
29 Oct 2022 — PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. PwnDoc hasta 0.5.3 podría permitir a atacantes remotos identificar nombres de cuentas de usuario deshabilitadas aprovechando los mensajes de respuesta para intentos de autenticación. • https://cve.nstsec.com/cve-2022-44023 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-31590
https://notcve.org/view.php?id=CVE-2021-31590
19 Jul 2021 — PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system. PwnDoc todas las versiones hasta la 0.4.0 (2021-08-23) tiene un manejo ... • https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23 •