CVE-2025-61777Critical· 9.4▾ AbyssalPoC availableFlag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without auth…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
1 GitHub repo (last check)
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates (GET) and /api/admin/badge-templates/create (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.
flagforge >= 2.0, < 2.3.2Upgrade past the affected range:
flagforge 2.3.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59932High· 8.6Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-59843Medium· 5.3Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-59841Critical· 9.8Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-59826High· 7.6Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-14528Medium· 5.3A vulnerability was detected in D-Link DIR-803 up to 1.04
CVE-2025-10952Medium· 5.3A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743