392 matches found
in dompdf/dompdf
Description DomPDF is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the filegetcontents function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate...
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
✍️ Description User with "Editor" rights can create a special book page containing tag with "src" property pointing to any external or internal resource. Exporting this page using default domPdf will result in firing request from server side. 🕵️♂️ Proof of Concept Updating page with malicious...
CVE-2020-36115
Stored Cross Site Scripting XSS vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'...
Cross site scripting
Stored Cross Site Scripting XSS vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'...
CVE-2020-36115
Stored Cross Site Scripting XSS vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'...
CVE-2020-36115
CVE-2020-36115 affects the EGavilan Media CRUD Operation (PHP/MySQL/Bootstrap/Dompdf) where the First Name or Last Name field in the Add New Record feature allows Stored XSS. The vulnerability is described as a Stored Cross Site Scripting (XSS) via input fields, with no explicit exploit details o...
CVE-2020-36115
Stored Cross Site Scripting XSS vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'...
EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting
Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting Exploit Author: Mahendra Purbia Vendor Homepage: http://egavilanmedia.com Software Link: https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/ Version: 1.0 Tested on: Windows 10 Vulnerable...
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Multiple plugins were found to be vulnerable to the Dompdf unauthenticated Local File Inclusion LFI vulnerability CVE-2014-2383. PoC...
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Multiple plugins were found to be vulnerable to the Dompdf unauthenticated Local File Inclusion LFI vulnerability CVE-2014-2383...
Denial Of Service (DoS)
dompdf is vulnerable to denial of service DoS. The attack exists because dompdf.php does not handle the parsing of PHP file properly, allowing an attacker to consume memory by providing files such as dompdfconfig.inc.php...
CVE-2014-5013
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383...
CVE-2014-5012
DOMPDF before 0.6.2 allows denial of service...
CVE-2014-5012
DOMPDF before 0.6.2 allows denial of service...
DEBIAN-CVE-2014-5011
DOMPDF before 0.6.2 allows Information Disclosure...
CVE-2014-5011
DOMPDF before 0.6.2 allows Information Disclosure...
CVE-2014-5013
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383...
DEBIAN-CVE-2014-5012
DOMPDF before 0.6.2 allows denial of service...