CCTFd

Products

Exploited and recent CVEs

• CVE-2026-121562 Medium 5.3 CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint 0.3%
• CVE-2024-11717 Medium 6.3 Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single us 0.7%
• CVE-2024-11716 Medium 5.3 While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pi 11.6%