CVE-2025-27363

CVE-2025-27363 en Chrome 113 Nota: En Chrome, esto no es una vulnerabilidad nueva, fue parcheada commit acumulativo en marzo de 2023. Este PoC solo apunta a Chrome en modo headless. Sin embargo, creo que es una lectura interesante si quieres explorar algunos internos y ver la explotación en...

CVE-2021-25094

CVE-2021-25094 Subida sin restricciones de archivos ZIP en addcustomfont del plugin Tatsu uso php p.php...

confusable-vision

confusable-vision 全球首个逐字体易混淆字符数据集。 哪些 Unicode 字符看起来像哪些字符，是从字体的轮廓而非像素中测量得出的。当前版本 2026.09.26 比较了 322 种字体中每个字母和数字所绘制的字形，采用每个字形在正文中的大小和基线位置。然后对 ASCII 字母和数字的相似字符进行原位检查：将它们置于常用字体中其他字母之间，以人们阅读时的大小呈现，并与公认为相似的字符对（如 0 和 O）进行比较。 addons.mozilla.org 使用 confusable-vision 中的字符来检查附加组件名称中的相似字符，已在 Mozilla...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Ejecución arbitraria de JavaScript en PDF.js Faltaba una verificación de tipo al manejar fuentes en PDF.js, lo que permitiría la ejecución arbitraria de JavaScript en el contexto de PDF.js. Esta vulnerabilidad afecta a Firefox 126, Firefox ESR 115.11 y Thunderbird...

EvilFontTool

EvilFontTool Una herramienta de engaño basada en fuentes para red teaming, investigación de seguridad y lo que sea. EvilFontTool oculta texto legible por máquina dentro de un documento que muestra un texto completamente distinto a un lector humano. Lo hace mediante Evil Fonts — fuentes que engaña...

WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting

WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF 字体表堆损坏 Microsoft Office wwlib 中的一个漏洞允许攻击者在受害者打开恶意 RTF 文档时，以受害者的权限实现远程代码执行。攻击者可以通过电子邮件附件（或其他方式）传递此文件。 背景 Microsoft Word 是 Microsoft Office 中包含的文字处理应用程序。默认安装下，Microsoft Word 处理富文本格式（RTF）文档。此类文档主要由基于 7 位 ASCII 的关键字组成，这些关键字共同封装了各种丰富的内容。 漏洞详情 Microsoft Word 中的 RTF...

WDBFontOverwrite

Aplicación de prueba de concepto para sobrescribir fuentes en iOS usando CVE-2022-46689. Funciona en iOS 16.1.2 y versiones anteriores probado en iOS 16.1 en dispositivos sin jailbreak. IPA disponible en la sección Releases. Fuentes incluidas: DejaVu Sans Condensed DejaVu Serif DejaVu Sans Mono G...

Malicious code in translate-base-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0ae1970321abd04ddd957d3135ee1d2eb64acee031428fa8f3cbcb8c48504b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-15999

CVE-2020-15999 CVE-2020-15999 Añadida fuente con tabla SBIX basada en Arial - https://docs.microsoft.com/en-us/typography/opentype/spec/sbix Se bloquea en ftview asan.png, pero por alguna razón no consigo que Chrome se bloquee. Los indicadores tampoco se establecen correctamente, por lo que...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

z80-sans

Z80 无衬线 你最喜欢的反汇编器是什么？我喜欢的是一个字体： https://github.com/user-attachments/assets/bb6ceb18-c2fd-40a9-be4f-202321a214d9 这个字体通过大量使用 OpenType 的 字形替换表（GSUB） 和 字形定位表（GPOS），将十六进制小写字符序列转换为反汇编后的 Z80 指令。 如果你只是想试试，可以在 ./test/z80-sans.ttf 找到一份副本。 安装 在 Debian GNU/Linux 12 上测试通过。注意，该 Debian 版本自带 ruby 版本 3，而 fontcust...

CVE-2026-49919

A flaw was found in FreeType. An attacker could cause an application crash leading to a Denial of Service DoS by tricking a user or application into rendering a specially crafted color font. This issue occurs due to an integer overflow during bitmap dimension calculations when blending color font...

CVE-2020-15999

CVE-2020-15999 Aquí encontrarás todos los recursos para ejecutar el PoC para el CVE-2020-15999 en Google Chrome y Ftview Ubuntu. Hay dos carpetas en este repositorio, una para cada programa. Google Chrome Para reproducir el exploit, tendrás que instalar una versión de Google Chrome anterior a la...

CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

CVE-2026-95512 Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

CVE-2026-95512

A flaw exists in the FreeType library, specifically within its CID font loader . A remote attacker could exploit this by tricking a user into opening content containing a specially crafted CID-keyed font . This font can trigger repeated allocations and decryptions of subroutine data across multip...

EUVD-2026-91327

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...