218 matches found
CVE-2025-14356
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7getgeneratedpdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2025-14356
CVE-2025-14356 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on uacf7_get_generated_pdf in all versions up to and including 3.5.33. The Wordfence report confirms authenticated users with Subscriber-level a...
Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.307 Vulnerability Details CVEID:CVE-2025-57810 DESCRIPTION: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in C...
CVE-2020-36867 Nagios XI < 5.7.3 Command Injection in Report PDF Download
Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped,...
Server-side Request Forgery (SSRF)
Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PDF generation process. An attacker can cause the server to send HTTP requests to internal or external...
Server-side Request Forgery (SSRF)
Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the PDF generation process. An attacker can cause the server to send HTTP requests to internal or external resources by submitting specially crafted I...
Arbitrary File Read
xml2rfc is vulnerable to Arbitrary file read. The vulnerability is due to improper input sanitization when generating PDF files, which allows an attacker to inject a malicious link element into the prepped RFCXML and read arbitrary files from the filesystem...
EUVD-2020-17524
Malware in sbrugna...
EUVD-2012-3174
Malware in sbrugna...
EUVD-2017-15165
Malware in sbrugna...
EUVD-2024-42856
Malicious code in bioql PyPI...
EUVD-2022-24411
Malicious code in bioql PyPI...
EUVD-2023-54993
Malicious code in bioql PyPI...
EUVD-2025-6921
Malicious code in bioql PyPI...
EUVD-2025-16671
Malicious code in bioql PyPI...
GHSA-9MV7-3C64-MMQW xml2rfc is vulnerable to arbitrary file reads through prepped files
Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...
The vulnerability of the PHP class tc-lib-pdf-font for generating PDF documents by TCPDF allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the PHP class tc-lib-pdf-font for generating PDF documents via TCPDF is related to improper handling of the generation process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
GHSA-CFMV-H8FX-85M7 xml2rfc has an arbitrary file read vulnerability
Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. Credits This vulnerability was reporte...
PT-2025-36708
Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. Credits This vulnerability was reporte...
PT-2025-39842
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue occurs during the generation of PDF files where an attacker can read arbitrary files from the filesystem. This is achieved by injecting a malicious link...