CVE-2025-64512-Polyglot-PoC

CVE-2025-64512 Carga útil políglota En las últimas semanas en noviembre de 2025, se reveló una vulnerabilidad interesante CVE-2025-64512 en pdfminer.six, un popular proyecto de Python para procesar archivos PDF, utilizado en particular en pipelines de IA. La vulnerabilidad permite la ejecución...

Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 XSS almacenado Vulnerabilidad PoC de XSS almacenado en CMS Resumen Este repositorio demuestra una vulnerabilidad de XSS almacenado encontrada en la plataforma Wagtail 6.4.1 CMS. Se incrusta un JavaScript malicioso en un archivo PDF, y cada ve...

cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Electron 的应用程序，这些应用程序（间接）使用 PDF.js 进行预览功能。...

CVE-2026-93381

Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X は、Syllabus モジュールのファイルアップロード機能を介した Stored Cross-Site Scripting XSS に対して脆弱です。 ベンダー: https://github.com/changeweb/Unifiedtransform PoC ステップ 1: アプリケーションにログインし、Academic モジュールに移動します。 ステップ 2: Academic モジュールから、セッション、学期、クラス、コースをランダムなデータで作成します。 ステップ 3: Syllabus...

CVE-2024-4367-hands-on-01

!IMPORTANT 本仓库用于学习漏洞。 本次动手实践请务必在自己管理下的合适计算机上进行。绝对不要进行违法行为。 此外，因本仓库产生的任何损害・责任，作者概不承担。 CVE-2024-4367-hands-on 体验 CVE-2024-4367 的动手实践 创建 poc.pdf root@kitploit: python CVE-2024-4367-PoC/CVE-2024-4367.py "alert'document.domain'" 引用来源：https://github.com/LOURC0D3/CVE-2024-4367-PoC 将创建攻击用的 poc.pdf。...

CVE-2025-66837

CVE-2025-66837 恶意文件上传 描述 ARIS 中的文件上传漏洞允许攻击者通过上传特制的 PDF 文件/恶意软件来执行任意代码 CVSS 评分：6.8（中危） 攻击类型 远程（需认证） 受影响版本 10.0.23.0.3587512 及更早版本 产品供应商 software ag 受影响产品 ARIS 受影响组件 文件上传 API 缓解措施 验证上传文件的内容。 漏洞详情 用户将下载攻击者上传的 PDF 文件/恶意软件，并在打开文件后执行恶意代码。 已修复版本 大于 10.0.23.0.3587512 的版本 发现者： Yazan Abu-Nadi...

CVE-2024-38077-check

漏洞分析异步pdf文件。本人能力有限，还无法rce。请大佬指教。 漏洞验证只需要更改ip即可 root@kitploit: if name == 'main': printlogo connecttolicenseserver"192.168.6.132"...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Poppler

A vulnerability was discovered in the freedesktop Poppler version 20.12.1. This vulnerability allows remote attackers to trigger a Denial-of-Service DoS attack through a crafted .pdf file, targeting the FoFiType1C::cvtGlyph function...

CVE-2024-4367

CVE-2024-4367 POC 使い方 root@kitploit: python poc.py mal.pdf "alert'0xr2r'" 参照 CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC スキャナー templates...

The vulnerability of PDF components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created PDF file...

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially created PDF file...

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially created PDF file...

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge web browsers allows attackers to gain access to confidential data and compromise data integrity.

The vulnerability of the File System Access component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and influence data integrity through a specially created PDF file...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-79021

Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted PDF file. Chromium security severity: Low...

CVE-2026-79021

CVE-2026-79021 is a missing authorization flaw in the InterestGroups component of Google Chrome prior to 152.0.7977.65 . An attacker who has already compromised the renderer process can use a crafted PDF file to bypass system access restrictions . The flaw carries a Low Chromium severity and a CV...

CVE-2026-79119

Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: Low...

PT-2026-81564

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in SiteIsolation allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolation is a securi...