TCPDF Cross-site Scripting vulnerability

TCPDF before 6.7.4 mishandles calls that use HTML syntax...