PT-2023-12337

Name of the Vulnerable Software and Affected Versions DomPDF versions prior to 2.0.0 Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file get contents function. An attacker who can upload files of any type to the server...

DOMPDF denial of service vulnerability

DOMPDF before 0.6.2 allows denial of service...

DOMPDF Remote Code Execution

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383...

DOMPDF Information Disclosure

DOMPDF before 0.6.2 allows Information Disclosure...

GHSA-JWF8-MJJ8-R8HQ DOMPDF Information Disclosure

DOMPDF before 0.6.2 allows Information Disclosure...

GHSA-Q83C-64C9-C42M DOMPDF denial of service vulnerability

DOMPDF before 0.6.2 allows denial of service...

GHSA-JJWJ-W3GC-GCW4 DOMPDF Remote Code Execution

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383...

DOMPDF Remote File Inclusion Vulnerability

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inputfile parameter...

GHSA-48R9-4V93-X4WH DOMPDF Remote File Inclusion Vulnerability

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inputfile parameter...

DOMPDF Arbitrary File Read

dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the...

GHSA-QR6Q-W4GJ-3865 DOMPDF Arbitrary File Read

dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the...

Remote Code Execution (RCE)

Dompdf is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the font type via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

Remote code injection in dompdf/dompdf

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

GHSA-X752-QJV4-C4HC Remote code injection in dompdf/dompdf

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

Input validation

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

Dompdf 跨站脚本漏洞

Dompdf is an HTML to PDF converter. A cross-site scripting vulnerability exists in Dompdf version 1.2.1 that allows remote code execution via a .php file in the src:url field of an @font-face cascading style sheet CSS statement...

PT-2022-18977 · Dompdf · Dompdf

Name of the Vulnerable Software and Affected Versions: Dompdf versions prior to 1.2.1 Description: The issue allows remote code execution via a .php file in the src field of an @font-face Cascading Style Sheets CSS statement within an HTML input file. This is a general information about the issue...