CVE-2020-21365

CVE-2020-21365 affects wkhtmltopdf up to version 0.12.5, enabling a directory traversal that allows reading local files via crafted HTML processed with default settings. Public advisories from Debian, Mageia, and Ubuntu confirm the vulnerability and note fixes/remediations: Debian DLA-3158 and US...

CVE-2020-21365

Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations...

CVE-2020-10390

OS Command Injection in export.php vulnerable function called from include/functions-article.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php...

PT-2019-6374 · Wkhtmltopdf +4 · Wkhtmltopdf +4

Name of the Vulnerable Software and Affected Versions: wkhtmltopdf versions 0.12.5 and earlier Description: The issue is related to a directory traversal vulnerability that allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the...

CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files...

CVE-2018-14865

The CVE-2018-14865 case concerns Odoo, specifically the Report engine in Odoo Community versions 9.0–11.0 and earlier and Odoo Enterprise versions 9.0–11.0 and earlier. The vulnerability stems from the Report engine not using secure options when passing documents to wkhtmltopdf, which can allow a...

CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files...

CVE-2018-14865

Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files...

Open Source Pentesting Management And Automation Platform: Vulnreport

Open Source Pentesting Management And Automation Platform Vulnreport is a platform for managing penetration tests and generating well-formatted, actionable findings reports without the normal overhead that takes up security engineer’s time. It is designed to accelerate management of penetration...

SA-CONTRIB-2010-082 - Print - Local file read access

The Printer, e-mail and PDF versions "print" module provides printer-friendly versions of content, including a PDF version that is generated by one of three supported generation tools dompdf, TCPDF and wkhtmltopdf. When using the wkhtmltopdf PDF generation tool, that tool is able to access local...