Pentestgpt
Monthly
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.