CVE-2025-24885CWE-284CWE-79

pwn.college has a XSS on dojo pages

High · published January 30, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-30T22:41Z
EPSS history
Timeline
  • 30 JAN 22:41Z
    pwn.college has a XSS on dojo pages
    cvelistv5