PT-2025-32596

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 1.1.0 Description: Stirling-PDF is a locally hosted web application used for PDF file operations. Prior to version 1.1.0, the application is susceptible to Server-Side Request Forgery SSRF when utilizing the...

Stirling-PDF code issue vulnerabilities

Stirling-PDF is a powerful, locally hosted, web-based PDF manipulation tool using Docker, open-sourced by Stirling Tools. A code issue vulnerability exists in Stirling-PDF versions prior to 1.1.0 that stems from a cleaner in the Markdown to PDF feature that can be bypassed, potentially leading to...

CVE-2025-55161: Server-Side Request Forgery (SSRF)

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

Linux Distros Unpatched Vulnerability : CVE-2025-3512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to...

Linux Distros Unpatched Vulnerability : CVE-2024-32875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in...

VulnCheck KEV: CVE-2025-53833

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

SUSE CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

SUSE CVE-2025-52902

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a...

Regular Expression Denial of Service (ReDoS)

Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the sortahtmltokenizere regex used in the HTML tokenizer due to improperly constraining quoted attribute values ".?",...

Cross-site Scripting (XSS)

Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS in safemode due to improper handling of incomplete HTML tags. The encodeincompletetags function fails to properly check for auto links, allowin...

org.apache.jspwiki.wikipages:jspwiki-wikipages-builder (2.12.2), org.apache.jspwiki.wikipages:jspwiki-wikipages-de (2.12.2) +10 more potentially affected by CVE-2025-24853 via org.apache.jspwiki:jspwiki-markdown (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-markdown MAVEN version =2.11.0.m1, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24853 Source advisory: OSV:GHSA-RRFF-CHJ9-W4C7...

org.apache.jspwiki.wikipages:jspwiki-wikipages-builder (2.12.2), org.apache.jspwiki.wikipages:jspwiki-wikipages-de (2.12.2) +10 more potentially affected by CVE-2025-24853 via org.apache.jspwiki:jspwiki-markdown (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-markdown MAVEN version =2.11.0.m1, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24853 Source advisory: GHSA-RRFF-CHJ9-W4C7...

org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0.m1, <=2.12.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0.m7, <=2.12.2) +5 more potentially affected by CVE-2025-24854 via org.apache.jspwiki:jspwiki-main (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0.m1, =2.11.0.m1, =2.11.0.m7, =2.11.0.m7, =2.11.0, =2.11.0.m1, =2.11.0.m4, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24854 Source advisory: OSV:GHSA-72WW-4RCW-MC62...

org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0.m1, <=2.12.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0.m7, <=2.12.2) +5 more potentially affected by CVE-2025-24854 via org.apache.jspwiki:jspwiki-main (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0.m1, =2.11.0.m1, =2.11.0.m7, =2.11.0.m7, =2.11.0, =2.11.0.m1, =2.11.0.m4, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24854 Source advisory: GHSA-72WW-4RCW-MC62...

org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0.m1, <=2.12.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0.m7, <=2.12.2) +5 more potentially affected by CVE-2025-24854 via org.apache.jspwiki:jspwiki-main (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0.m1, =2.11.0.m1, =2.11.0.m7, =2.11.0.m7, =2.11.0, =2.11.0.m1, =2.11.0.m4, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24854 Source advisory: SNYK:JAVA-ORGAPACHEJSPWIKI-11357915...

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

GHSA-RRFF-CHJ9-W4C7 Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

org.apache.jspwiki.wikipages:jspwiki-wikipages-builder (2.12.2), org.apache.jspwiki.wikipages:jspwiki-wikipages-de (2.12.2) +10 more potentially affected by CVE-2025-24853 via org.apache.jspwiki:jspwiki-markdown (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-markdown MAVEN version =2.11.0.m1, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24853 Source advisory: MEND:CVE-2025-24853...

org.apache.jspwiki.it:jspwiki-selenide-tests (>=2.11.0.m1, <=2.12.2), org.apache.jspwiki:jspwiki-210-adapters (>=2.11.0.m7, <=2.12.2) +5 more potentially affected by CVE-2025-24853 via org.apache.jspwiki:jspwiki-main (>=2.11.0.m1, <=2.12.2)

org.apache.jspwiki:jspwiki-main MAVEN version =2.11.0.m1, =2.11.0.m1, =2.11.0.m7, =2.11.0.m7, =2.11.0, =2.11.0.m1, =2.11.0.m4, =2.11.0.m1, =2.12.2 Source cves: CVE-2025-24853 Source advisory: MEND:CVE-2025-24853...

CVE-2025-24853 Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...