2604 matches found
CVE-2025-2977 GFI KerioConnect PDF File cross site scripting
A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been...
CVE-2025-2977 GFI KerioConnect PDF File cross site scripting
A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been...
CVE-2025-2977
CVE-2025-2977 affects GFI KerioConnect 10.0.6, with a vulnerability in the PDF File Handler that leads to cross-site scripting (XSS) . The flaw is exploitable remotely and, per sources, the exploit has been disclosed publicly. The exact affected functionality is described as an unknown function w...
GFI KerioConnect 代码注入漏洞
GFI KerioConnect is an enterprise-grade email and collaboration solution from GFI that provides mail, calendar, contacts, tasks, and file sharing. A code injection vulnerability exists in GFI KerioConnect version 10.0.6, which stems from a cross-site scripting vulnerability in the PDF File Handle...
CVE-2024-12871 Stored Cross-site Scripting (XSS) in infiniflow/ragflow
An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or...
CVE-2025-25683
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...
CVE-2025-25683
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...
CVE-2025-25683
CVE-2025-25683 affects AlekSIS-Core versions 3.0–3.2.1, with an underlying Incorrect Access Control that allows unauthenticated users to access all PDF files. Exploitation details are not provided in the documents, but multiple sources confirm the vulnerability and affected ranges. Remediation (w...
CVE-2024-55199
A Stored Cross Site Scripting XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file through the file upload feature. When the file is rendered, the injected code is executed on the user's browser...
CVE-2024-55199
A Stored Cross Site Scripting XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file through the file upload feature. When the file is rendered, the injected code is executed on the user's browser...
CVE-2024-55199
CVE-2024-55199 describes a Stored XSS in Celk Sistemas Celk Saude v3.1.252.1. The vulnerability allows an attacker to embed JavaScript inside a PDF uploaded via the file-upload feature; when the PDF is rendered, the script executes in the user’s browser. Affected product/version: Celk Saude v3.1....
Adobe Reader 11.0.10 CoolType Out-Of-Bounds Read
Adobe Reader version 11.0.10 proof of concept exploit that demonstrates an out-of-bounds read found in 2015. ============================================================================================================================================= | Title : Adobe Reader 11.0.10 CoolType...
CVE-2025-1918
Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. Chromium security severity: Medium...
CVE-2025-1918
CVE-2025-1918 is an out-of-bounds read vulnerability in PDFium used by Google Chrome prior to 134.0.6998.35. A crafted PDF file could trigger out-of-bounds memory access. The CVE is listed with a Chromium/Chrome security severity of Medium and a high impact on confidentiality, integrity, and avai...
CVE-2024-57240
A Cross-Site Scripting XSS vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execute arbitrary code via a crafted PDF file...
CVE-2024-57240
CVE-2024-57240 is an XSS in the Rendering Engine of Apryse WebViewer (v11.1 and earlier). The vulnerability allows arbitrary code execution via a crafted PDF file. Documents consistently describe the affected product/component and rationale but do not provide a remediation patch version or confir...
Multiple vulnerabilities in The LuxCal Web Calendar
Overview The LuxCal Web Calendar provided by LuxSoft contains multiple vulnerabilities listed below. SQL injection in pdf.php CWE-89 - CVE-2025-25221 SQL injection in retrieve.php CWE-89 - CVE-2025-25222 Path traversal in dloader.php CWE-22 - CVE-2025-25223 Missing authentication in dloader.php...
PT-2025-7061 · Unknown · Luxcal Web Calendar
Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns an SQL injection vulnerability in the pdf.php file. If exploited, this vulnerability may...