cve/2025/CVE-2025-23044.md

### [CVE-2025-23044](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23044)
![](https://img.shields.io/static/v1?label=Product&message=pwndoc&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2014acb704891245bf1703ce6296d62112e85aa995%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen)

### Description

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.

### POC

#### Reference
- https://github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rq

#### Github
No PoCs found on GitHub currently.