CVE-2025-57462

CVE-2025-57462 Descripción: XSS almacenado mediante carga de archivos maliciosos en machpanel 8.0.32. POC: Navega a https://controlpaneldomain/Client/SubmitTicket.aspx y sube un archivo PDF que contenga scripts XSS en los metadatos. Después de enviar el ticket, puedes ejecutar el script XSS...

Masscan-Report

Generador de Informes de Masscan Una herramienta Python que genera visualizaciones HTML interactivas basadas en React a partir de la salida JSON de masscan, con un gráfico de red dirigido por fuerzas de D3.js. Captura de pantalla Características Gráfico de Red Interactivo Visualización dirigida p...

cve-2025-54988-VulnTikaProject

Proyecto de Prueba de Vulnerabilidad de Apache Tika Esta es una aplicación Spring Boot que utiliza Apache Tika 3.2.1 para el procesamiento de documentos y extracción de texto. Requisitos previos Tener Docker Uso ./start-app.sh o docker compose up -d Ejecución de CVE Sube tu PDF malicioso...

PDF Generator for WordPress < 1.1.2 - Cross Site Scripting

The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin id: CVE-2022-4321 info: name: PDF Generator for WordPress 1.1.2 - Cross Site Scripting author: r3Y3r53,HuTa0 severity: medium...

Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which...

Gotenberg - Command Injection

Gotenberg 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request. id: CVE-2026-42589 info: name: Gotenberg - Command Injection...

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting

The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. id: CVE-2017-18528 info: name: PDF & Print by BestWebSoft 1.9.4 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. impact: |...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. id: CVE-2022-1392 info: name: WordPress Videos sync PDF =1.7.5 or apply the vendor-provided patch to mitigate the vulnerability. reference...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

Stirling-PDF < 1.1.0 - Server-Side Request Forgery

Stirling-PDF 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access. id: CVE-2025-55150 info: name: Stirling-PDF 1.1.0 - Server-Si...

CVE-2019-13288

CVE-2019-13288 – Recursión Infinita en Parser::getObj de Xpdf Resumen CVE-2019-13288 es una vulnerabilidad identificada en Xpdf versión 4.01.01 , específicamente dentro de la función Parser::getObj en Parser.cc. Este fallo puede provocar recursión infinita al procesar un archivo PDF especialmente...

CVE-2026-95338

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code within the browser's sandbox by convincing a user to open a specially crafted PDF document. This issue is caused by a use-after-free vulnerability in the PDFium component, where memory is improperly accessed after ...

CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection Proof of Concept for CVE-2026-61797 , a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin. The vulnerability can be reached through: /marketplace/pdf/front/preference.form.php In the vulnerable implementation...

CVE-2024-54819

CVE-2024-54819 Lea más detalles en: https://www.partywave.site acerca de CVE-2024-54819 Solicitud POST para iniciar sesión El atacante debe estar autenticado POST /librarian/index.php/authentication HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:128.0 Gecko/20100101...

cisco-CVE-2023-31488

Acerca de Investigador de seguridad: ly1g3, ly1g3attuta.io Huella GPG: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Resumen: Correo electrónico a RCE de cero clics como root - Ejecución remota de código/Corrupción de memoria/Cadena ROP CVE: CVE-2023-3148...

PHP-Injection-in-M4-PDF-Extensions

PHP-Injection-in-M4-PDF-Extensions CVE-2023-50029 es una vulnerabilidad de inyección PHP en el módulo M4 PDF Extensions. Esta vulnerabilidad permite a los atacantes inyectar y ejecutar código PHP arbitrario en el servidor, lo que les otorga control total sobre el sistema objetivo. El problema...

CVE-2019-14811-in-pdf-exploit

CVE-2019-14811 PoC del exploit de vista previa de PDF de GhostScript Este exploit apunta a CVE-2019-14811 en entornos GS donde la salida PostScript no se refleja, pero sí se ejecuta, como en vistas previas de PDF mediante imágenes png. El exploit renderiza comandos directamente en la vista previa...

CVE-2025-32583

🚨 CVE-2025-32583 — Exploit RCE para WordPress PDF 2 Post Vulnerabilidad CRÍTICA CVE-ID: CVE-2025-32583 Severidad: 9.9 CRÍTICA Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Descripción Una vulnerabilidad en el plugin PDF 2 Post de WordPress desarrollado por termel permite la Inclusió...