CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

CVE-2014-2383-LFI-to-RCE-Escalation

CVE-2014-2383 LFI/RFI escalation to RCE Testing environment: dompdf 0.6.0 - php 7.3.33 - apache 2.4.25 During a security assessment the presence of CVE-2014-2383 was discovered. This document is a proof of concept and does not include the details from the initial discovery in order to protect...

Dompdf < v0.6.0 - Local File Inclusion

A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a...

dompdf-rce

dompdf 向け RCE エクスプロイト このリポジトリには、dompdf 1.2.0 を使用した脆弱なデモアプリケーションと、ttf+php ポリグロットファイルを介してリモートコード実行を実現するエクスプロイトが含まれています。 詳細は、https://positive.security/blog/dompdf-rce をご覧ください。 手順 1. デモアプリケーションを実行します $ cd application $ php -S localhost:9000 2. エクスプロイトサーバーを実行します $ cd exploit $ php -S localhost:9001 3...

dompdf-rce

RCE exploit for dompdf This repository contains a vulnerable demo application using dompdf 1.2.0 and an exploit that achieves remote code execution via a ttf+php polyglot file. For more details, please visit https://positive.security/blog/dompdf-rce Instructions 1. Run the demo application $ cd...

CVE-2023-23924

CVE-2023-23924 Dompdf vulnerable to URI validation failure on SVG parsing · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg Run Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php Check Check the "whoami" command ...

CVE-2026-59941

CVE-2026-59942: Dompdf Resource Exhaustion DoS - Proof of Concept Vulnerability Type: Denial of Service DoS via Resource Exhaustion Affected Software: Dompdf = 3.1.5 Credits: Fabian Rosales far00t01. Disclaimer This repository and its content are provided for educational and research purposes onl...

Dompdf-Exploit-RCE

Dompdf-Exploit-RCE An exploit script for CVE-2022-28368 designed to make exploitation less annoying, made for a HTB machine Made to make the exploit less tedious and annoying...

CVE-2022-41343

CVE-2022-41343 🐍 Python Exploit for CVE-2022-41343 Staged Reverse Shell for dompdf 2.0.1 Based on: Positive Sec's write-up and PoC Example cve-2022-41343 10.10.16.3 44444 Usage usage: cve-2022-41343 -h -l SERVERPORT -s SHELL -n FONTNAME ip port positional arguments: ip Shell Callback IP...

VulnCheck KEV: CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2026-59941 — Updated!

CVE-2026-59942: Dompdf Resource Exhaustion DoS - Proof of Concept Vulnerability Type: Denial of Service DoS via Resource Exhaustion Affected Software: Dompdf = 3.1.5 Credits: Fabian Rosales far00t01. Disclaimer This repository and its content are provided for educational and research purposes onl...

CLSA-2026-1787828763 TuxCare security update for dompdf/dompdf (6 CVEs)

TuxCare rebuilt dompdf/dompdf to address 6 CVEs. Fixed in 0.8.6-p2+tuxcare...

CLSA-2026-1787223739 TuxCare security update for dompdf/dompdf (6 CVEs)

TuxCare rebuilt dompdf/dompdf to address 6 CVEs. Fixed in 1.2.2-p2+tuxcare...

CLSA-2026-1786371522 TuxCare security update for dompdf/dompdf (5 CVEs)

TuxCare rebuilt dompdf/dompdf to address 5 CVEs. Fixed in 3.1.0-p1+tuxcare...

CLSA-2025-1766019429 TuxCare security update for dompdf/dompdf (7 CVEs)

TuxCare rebuilt dompdf/dompdf to address 7 CVEs. Fixed in 1.2.2-p1+tuxcare...

CLSA-2025-1766364765 TuxCare security update for dompdf/dompdf (8 CVEs)

TuxCare rebuilt dompdf/dompdf to address 8 CVEs. Fixed in 0.8.6-p1+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-56722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a targ...

Linux Distros Unpatched Vulnerability : CVE-2026-59942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can...

Linux Distros Unpatched Vulnerability : CVE-2026-59941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header...

Linux Distros Unpatched Vulnerability : CVE-2026-59943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can...