CVE-2025-69624

Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert. When app.alert is called with more than one argument and the first argument evaluates to null for example, app.alertapp.activeDocs, true when app.activeDocs is...

PT-2026-32375

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro for Windows version 14.41.1.4 Description A NULL pointer dereference occurs when the software attempts to read a memory location that is null, leading to a crash. This issue allows attackers to cause a Denial of Service DoS by...

Nitro PDF Pro security vulnerabilities

Nitro PDF Pro is a PDF editing and management tool developed by the American company Nitro. Version 14.41.1.4 of Nitro PDF Pro for Windows contains a security vulnerability. This vulnerability stems from the use of the this.mailDoc method, where heap deallocation is reused after deallocation, whi...

CVE-2025-69627: Use After Free

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc. During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper...

CVE-2025-69624

Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert. When app.alert is called with more than one argument and the first argument evaluates to null for example, app.alertapp.activeDocs, true when app.activeDocs is...

CVE-2025-69627

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc. During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper...

CVE-2025-69627

Nitro PDF Pro for Windows version 14.41.1.4 is vulnerable to a heap use-after-free vulnerability within the this.mailDoc() JavaScript method. The issue occurs because an internal XID object is freed prematurely, yet its pointer is still accessed by UI and logging helper functions. This allows dow...

CVE-2025-69624

Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert. When app.alert is called with more than one argument and the first argument evaluates to null for example, app.alertapp.activeDocs, true when app.activeDocs is...

CVE-2025-69624

Nitro PDF Pro for Windows versions before 14.43 is vulnerable to a NULL pointer dereference within the JavaScript implementation of the app.alert() function. When the function is called with multiple arguments where the first argument is null (e.g., app.alert(app.activeDocs, true) when app.active...

CVE-2025-66769

A NULL pointer dereference vulnerability exists in Nitro PDF Pro for Windows v14.41.1.4 . This flaw allows an attacker to cause a Denial of Service (DoS) by providing a crafted XFA packet . No specific remediation or exploit details are provided in the documents.

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

Google Chrome PDF Bypass

The vulnerability of the Google Chrome browser’s PDF component is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions by sending a specially crafted HTML page...

Foxit PDF Services API security vulnerabilities

The Foxit PDF Services API is a set of cloud-based PDF services provided by the American company Foxit, offering capabilities for document processing and format conversion. There is a security vulnerability in the Foxit PDF Services API. This vulnerability allows attackers to control server-side...

EUVD-2019-20137

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

CVE-2019-25707 eBrigade ERP 4.5 SQL Injection via pdf.php

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

CVE-2019-25707

The CVE-2019-25707 entry affects eBrigade ERP 4.5, where an SQL injection exists in pdf.php via the id parameter. Authenticated attackers can send crafted GET requests to retrieve arbitrary SQL results, including table names and database schema details. Documents consistently describe this as a v...

PT-2026-32169

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

Exploit for CVE-2026-23500

CVE-2026-23500: OS Command Injection RCE via MAINODTASPDF...

Pypdf: Manipulated XMP Metadata Entity Declarations Can Exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in "pypdf==6.10.0" https://github.com/py-pdf/pypdf/releases/tag/6.10.0. Workarounds If you cannot upgrade yet, consider applying th...