Foxit PDF Services API security vulnerabilities

The Foxit PDF Services API is a set of cloud-based PDF services provided by the American company Foxit, offering capabilities for document processing and format conversion. There is a security vulnerability in the Foxit PDF Services API. This vulnerability allows attackers to control server-side...

CVE-2025-69624

Nitro PDF Pro for Windows versions before 14.43 is vulnerable to a NULL pointer dereference within the JavaScript implementation of the app.alert() function. When the function is called with multiple arguments where the first argument is null (e.g., app.alert(app.activeDocs, true) when app.active...

CVE-2025-69627

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc. During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper...

CVE-2025-69624

Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert. When app.alert is called with more than one argument and the first argument evaluates to null for example, app.alertapp.activeDocs, true when app.activeDocs is...

CVE-2025-69627

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc. During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper...

CVE-2025-66769

A NULL pointer dereference vulnerability exists in Nitro PDF Pro for Windows v14.41.1.4 . This flaw allows an attacker to cause a Denial of Service (DoS) by providing a crafted XFA packet . No specific remediation or exploit details are provided in the documents.

PT-2026-34687

A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service DoS crash via a crafted PDF file in OutlineItem::open...

PT-2026-32376

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro for Windows version 14.41.1.4 Description A NULL pointer dereference occurs in the JavaScript implementation of the app.alert function. When app.alert is called with multiple arguments and the first argument evaluates to null, th...

PT-2026-32377

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro for Windows version 14.41.1.4 Description A heap use-after-free issue exists in the implementation of the JavaScript method this.mailDoc. During execution, an internal XID object is allocated and freed prematurely, but the freed...

EUVD-2019-20137

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

CVE-2019-25707

The CVE-2019-25707 entry affects eBrigade ERP 4.5, where an SQL injection exists in pdf.php via the id parameter. Authenticated attackers can send crafted GET requests to retrieve arbitrary SQL results, including table names and database schema details. Documents consistently describe this as a v...

CVE-2019-25707 eBrigade ERP 4.5 SQL Injection via pdf.php

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

PT-2026-32169

eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to pdf.php with crafted SQL payloads in the 'id' parameter to extract sensitive...

Exploit for CVE-2026-23500

CVE-2026-23500: OS Command Injection RCE via MAINODTASPDF...

Pypdf: Manipulated XMP Metadata Entity Declarations Can Exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in "pypdf==6.10.0" https://github.com/py-pdf/pypdf/releases/tag/6.10.0. Workarounds If you cannot upgrade yet, consider applying th...

Chromium: CVE-2026-5894 Inappropriate implementation in PDF

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-40260 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-40260 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-40260 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

CVE-2026-31017

A Server-Side Request Forgery SSRF vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered into PDF. When generating PDFs from user-controlled HTML content, the application...