PT-2026-1687

A critical Arbitrary File Read vulnerability CVE-2023-50024 has been discovered in the jsPDF library, a popular JavaScript library for client-side PDF generation. Adobe CyberSecNews CyberSecurityAwareness DataSecurity Spyware...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the loadFile, addImage, html and addFont functions. An attacker can access and include arbitrary files from the local file system into generated PDFs. Workaround This vulnerability can be...

PT-2025-136: Path Traversal in mPDF

The vulnerability was identified in mPDF, version 2.8.5. The application performs improper validation of data received from the user, which allows an attacker to read files stored on the server. Vulnerability status: Confirmed during research Date of vulnerability discovery: 11.04.2025...

CVE-2025-14356

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7getgeneratedpdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-14356

CVE-2025-14356 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on uacf7_get_generated_pdf in all versions up to and including 3.5.33. The Wordfence report confirms authenticated users with Subscriber-level a...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.307 Vulnerability Details CVEID:CVE-2025-57810 DESCRIPTION: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in C...

CVE-2020-36867 Nagios XI < 5.7.3 Command Injection in Report PDF Download

Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped,...

Server-side Request Forgery (SSRF)

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PDF generation process. An attacker can cause the server to send HTTP requests to internal or external resources by submitting specially crafted I...

Server-side Request Forgery (SSRF)

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PDF generation process. An attacker can cause the server to send HTTP requests to internal or external...

Arbitrary File Read

xml2rfc is vulnerable to Arbitrary file read. The vulnerability is due to improper input sanitization when generating PDF files, which allows an attacker to inject a malicious link element into the prepped RFCXML and read arbitrary files from the filesystem...

EUVD-2012-3174

Malware in sbrugna...

EUVD-2020-17524

Malware in sbrugna...

EUVD-2017-15165

Malware in sbrugna...

EUVD-2022-24411

Malicious code in bioql PyPI...

EUVD-2024-42856

Malicious code in bioql PyPI...

EUVD-2025-6921

Malicious code in bioql PyPI...

EUVD-2025-16671

Malicious code in bioql PyPI...

EUVD-2023-54993

Malicious code in bioql PyPI...

GHSA-9MV7-3C64-MMQW xml2rfc is vulnerable to arbitrary file reads through prepped files

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...

GHSA-CFMV-H8FX-85M7 xml2rfc has an arbitrary file read vulnerability

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. Credits This vulnerability was reporte...