Flagforge

Flagforge versions 2.3.2 and earlier suffer from a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint that accepts unvalidated usernames containing regex metacharacters, allowing unauthenticated remote attackers to trigger excessive CPU consumption and deny service to legitimate users. The MongoDB regex engine processes these malicious patterns inefficiently, making the platform unavailable without administrator intervention. No patch is currently available; users should implement WAF rules to filter regex metacharacters from username inputs as a temporary mitigation.

Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Flag Forge is a Capture The Flag (CTF) platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.