https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-27413.htmlhttps://patchthecve.com/cve/CVE-2025-27413.htmlWed, 17 Jun 2026 09:03:32 +0000MEDIUM 6.5: PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from thhttps://patchthecve.com/cve/CVE-2025-27410.htmlhttps://patchthecve.com/cve/CVE-2025-27410.htmlWed, 17 Jun 2026 09:03:32 +0000MEDIUM 6.5: PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the https://patchthecve.com/cve/CVE-2024-55653.htmlhttps://patchthecve.com/cve/CVE-2024-55653.htmlWed, 17 Jun 2026 08:11:21 +0000MEDIUM 6.5: PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the rehttps://patchthecve.com/cve/CVE-2024-55602.htmlhttps://patchthecve.com/cve/CVE-2024-55602.htmlWed, 17 Jun 2026 08:11:18 +0000HIGH 7.6: PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d421