CVE-2025-24885 - CVE House

Status published High CVE-2025-24885

pwn.college has a XSS on dojo pages

7.6 CVSS

Vulnerability Description

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24885

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/pwncollege/dojo/security/advisories/GHSA-8m79-rmhw-rg84

More from pwncollege

View All →

CVE-2025-62376

pwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM access

Critical 9.5

CVE-2025-24886

pwn.college has Symlink LFI in Dojo repos

High 7.7

Affected Vendor

pwncollege

View all reports →

Affected Software

dojo

Vulnerable Versions:

<= 613e4fd654b16e5e0888e9205702bde83de91c60

Timeline

Official Publish: January 30th, 2025

Last Modified: January 31st, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-284 CWE-79

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

Persistence

T1213 Data from Information Repositories

Collection

T1565.002 Stored Data Manipulation

Impact

T1189 Drive-by Compromise

Initial Access

T1059.007 JavaScript

Execution

T1539 Steal Web Session Cookie