pandatix

4 exploits Active since Oct 2020
CVE-2021-28378 NOMISEC LOW WRITEUP
Gitea 1.12.0-1.12.5 and < 1.13.4 - Cross-Site Scripting via Issue Data
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
4 stars
CVSS 3.7
CVE-2025-53632 NOMISEC CRITICAL WORKING POC
ctfer-io chall-manager < 0.1.4 - Unauthenticated Path Traversal via Zip Slip
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.
CVSS 9.1
CVE-2020-14144 WRITEUP HIGH WRITEUP
Gitea 1.1.0-1.12.5 - Authenticated Remote Code Execution via Git Hook Script Injection
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
CVSS 7.2
CVE-2021-28378 WRITEUP LOW WRITEUP
Gitea 1.12.0-1.12.5 and < 1.13.4 - Cross-Site Scripting via Issue Data
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
CVSS 3.7