28829 matches found
PT-2026-5717
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the...
PT-2026-5721
Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.1.0 Description A flaw exists in jsPDF, a JavaScript library for generating PDFs, where user control over properties and methods within the Acroform module can lead to the injection of arbitrary PDF objects, including...
python311-pypdf-6.6.2-1.1 on GA media (moderate)
python311-pypdf-6.6.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10116-1 Rating: moderate Cross-References: CVE-2026-24688 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
SUSE CVE-2026-24688
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects...
CVE-2026-0483
Stored Cross-Site Scripting XSS vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link...
[SECURITY] Fedora 43 Update: weasyprint-68.0-1.fc43
WeasyPrint can render HTML and CSS to PDF. It aims to support web standards for printing...
OPENSUSE-SU-2026:10116-1 python311-pypdf-6.6.2-1.1 on GA media
These are all security issues fixed in the python311-pypdf-6.6.2-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2020-36944
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...
CVE-2020-36944 ILIAS Learning Management System 4.3 - SSRF
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...
CVE-2020-36944 ILIAS Learning Management System 4.3 - SSRF
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
CVE-2026-0483
Stored Cross-Site Scripting XSS vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link...
CVE-2026-0483
CVE-2026-0483 is a stored XSS in Live Helper Chat’s PDF file upload for versions before 4.72. An attacker can upload a malicious PDF containing an XSS payload; when a user downloads and opens the file via the app’s link, arbitrary JavaScript executes in the user’s context. Public sources (PT Secu...
CVE-2026-0483 Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat
Stored Cross-Site Scripting XSS vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link...
CVE-2026-0483
Stored Cross-Site Scripting XSS vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue, information disclosure in the PDF Viewer component...
ILIAS code-related vulnerabilities
ILIAS is an open-source learning management system developed by ILIAS. Version 4.3 of ILIAS has code-related vulnerabilities; these vulnerabilities stem from server-side request forgery in the portfolio PDF export function, which may lead to the reading of local files...