Stirling-PDF < 1.1.0 - Server-Side Request Forgery

Stirling-PDF 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access. id: CVE-2025-55150 info: name: Stirling-PDF 1.1.0 - Server-Si...

CVE-2023-33733

CODE INJECTION VULNERABILITY IN REPORTLAB PYTHON LIBRARY tl;dr This write-up details how an RCE in Reportlab - was found and exploited. Due to the prevalence of Reportlab in HTML to PDF processing, this vulnerability may be reachable in many applications that process PDF files, making this an...

CVE-2026-111417

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111418

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111417

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is the use of a shared token for submitted conversion documents, which may allow unauthorized users to access documents submitted by others. While the vulnerability is conf...

EUVD-2026-112697

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

EUVD-2026-112696

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is that the service supports ZIP-formatted input , which can be used to bypass restrictions on requests to internal IP addresses. This could potentially allow ...

PT-2026-130683

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

PT-2026-130684

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

Foxit.com server request forgery vulnerability

Versions of Foxit prior to 2026-10-29 contain a server-side request forgery vulnerability. This vulnerability stems from Server-Side Request Forgery SSRF in the HTML-to-PDF conversion service. Inputting ZIP format files can bypass restrictions on requests directed at internal IP addresses,...

CVE-2026-111417: Foxit Software Inc. foxit.com: A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the…

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

CVE-2026-111418: Foxit Software Inc. foxit.com: A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

Foxit.com authorization issue vulnerability

Versions of Foxit prior to 2026-10-29 contain an authorization issue vulnerability. This vulnerability arises because the HTML-to-PDF conversion service uses shared tokens for submitted conversion documents; improper access control may allow unauthorized users to access documents submitted by oth...

CVE-2026-68523

fulgur is a Rust library that converts untrusted HTML/CSS into PDF, commonly used server-side to process input from many tenants. In versions prior to 0.19.0 , a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound ,...

CVE-2026-68537

Fulgur , a Rust library that converts untrusted HTML/CSS to PDF in multi-tenant server environments, is vulnerable to denial of service in versions prior to 0.19.0 . A body-direct child element whose CSS-resolved height greatly exceeds the page height is sliced into one fragment per page with no ...