Stored XSS Vulnerability in pwn.college Education Platform

CVE-2025-24885

What is CVE-2025-24885?

The pwn.college education platform suffers from a missing access control vulnerability that allows unprivileged users to create and render custom dojo pages. This flaw can lead to stored cross-site scripting (XSS), enabling attackers to inject malicious scripts which can affect other users accessing those pages. Given its educational focus, the potential for misuse in practical cybersecurity scenarios makes this vulnerability particularly concerning, emphasizing the need for rigorous security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References