cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This vulnerability allows an attacker to execute arbitrary JavaScript code immediately after opening a malicious PDF file. This affects all Firefox users 126, as Firefox uses PDF.js to display PDF files, but al...

CVE-2026-34621

CVE-2026-34621 : Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain — Research PoC Overview This repository contains research material and proof-of-concept code developed during the analysis of the 2026 Adobe Acrobat Reader in-the-wild exploit chain involving: Prototype Pollution Interna...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

CVE-2023-38831_ReverseShell_Winrar

CVE-2023-38831 In this case, I share the necessary files to exploit this vulnerability in WinRAR, with which we can create a malicious PDF to establish a reverse shell to our attacker machine. ⚠️ NOTE: This content is shared for ethical purposes and is created to practice in controlled environment...

CVE-2021-30860

CVE-2021-30860 CVE-2021-30860 FORCEDENTRY is a known vulnerability in MacOS, iOS, and WatchOS. It allows arbitrary code execution by sending a victim device a "maliciously crafted PDF". This vulnerability was patched by Apple on September 13, 2021 with the following versions: iOS 14.8 OSX Big Sur...

malicious-pdf

악성 PDF 생성기 ☠️ PDF 뷰어, 변환기, 웹 애플리케이션에서 폰-홈 콜백, SSRF, XSS, XXE, NTLM 자격 증명 도용 및 데이터 유출을 테스트하기 위한 67개의 악성 PDF 테스트 파일을 생성합니다. Burp Collaborator 또는 Interact.sh와 함께 사용할 수 있습니다. 침투 테스트, 버그 바운티 헌팅, 레드-팀 작업 등에 사용됩니다. 다양한 링크가 포함된 여러 PDF 파일을 생성할 도구가 필요하여 이 도구를 만들었습니다. 교육 및 전문 목적으로만 사용하세요. 사용법 pip install -r...

pdf.js-CVE-2024-4367

🚨 CVE-2024-4367 - Universal PDF.js Vulnerability Scanner ⚠️ CRITICAL SECURITY TOOL | Detects CVE-2024-4367 CVSS 9.8 - PDF.js Remote Code Execution Vulnerability Works on ANY website - Zero configuration required 📋 Table of Contents 📖 Overview ⚡ Quick Start 🔍 What It Detects 🛠️ How It Works 📊 Output...

CVE-2025-64512-exploit

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE 📋 Description This repository contains a proof-of-concept exploit for CVE-2025-64512 , a critical vulnerability in pdfminer.six versions prior to 20251107. The vulnerability allows an attacker to achieve Remote Code Execution RCE by uploadin...

CVE-2026-3462

CVE-2026-3462 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CWE-1321 CVE-2026-34621 - Advanced Cross-Platform Exploit Generator =========================================================== Generates a malicious PDF that exploits Adobe...

CVE-2025-20260

CVE-2025-20260 EXPLOIT This repository contains both the python script to generate the malicious pdf file and a core dump analysis...

cve-2025-54988-VulnTikaProject

Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...

CVE-2026-84311

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF document containing specially structured XForm objects. Processing this document can lead to excessive iteration, causing the application to consume significant memor...

CVE-2026-84310

A flaw was found in pypdf. A remote attacker could craft a malicious PDF document with specially designed outlines. Processing this document would cause the pypdf library to consume excessive processing time and memory, leading to a Denial of Service DoS condition. This vulnerability is due to a...

Astra Linux – Vulnerability in Poppler

A flaw was discovered in Poppler regarding the way certain PDF files are converted into HTML format. A remote attacker could exploit this flaw by providing a malicious PDF file. When such a file is processed by the ‘pdftohtml’ program, it could cause the application to crash, resulting in a denia...

EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2026-3147)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2026-3093)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

CVE-2026-8325

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

GHSA-HQ66-CQWQ-W95J PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true which is the default value and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches Workarounds Set...

EulerOS 2.0 SP13 : python-pillow (EulerOS-SA-2026-3042)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...