Skip to content
OpenAdvisories

Vendor

pwncollege

4 known vulnerabilities.

Products

dojo 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.3
    CVE-2026-25117

    pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

    pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin a…

    pwncollege dojo
  • High 7.6
    CVE-2025-24885

    pwn.college has a XSS on dojo pages

    pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.

    pwncollege dojo
  • High 7.7
    CVE-2025-24886

    pwn.college has Symlink LFI in Dojo repos

    pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user…

    pwncollege dojo