CVE-2025-66837

CVE-2025-66837 Malicious File Upload Description A file upload vulnerability in ARIS allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware CVSS Score: 6.8 Medium Attack Type Remote Authenticated Affected Versions Versions before 10.0.23.0.3587512 Discovered By: Yazan...

CVE-2024-38077-check

Vulnerability analysis asynchronous pdf file. My ability is limited, unable to achieve RCE yet. Please advise, masters. For vulnerability verification, just change the IP. if name == 'main': printlogo connecttolicenseserver"192.168.6.132"...

cve-2024-4367-PoC-fixed

cve-2024-4367-PoC-fixed PDF.js is a JavaScript-based PDF viewer maintained by Mozilla. This vulnerability allows an attacker to execute arbitrary JavaScript code immediately after opening a malicious PDF file. This affects all Firefox users 126, as Firefox uses PDF.js to display PDF files, but al...

CVE-2024-27665

CVE-2024-27665 Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting XSS via file upload feature in Syllabus module. Vendor: https://github.com/changeweb/Unifiedtransform PoC Step 1: Log in to the Application and Navigate to Academic module. Step 2: Create Session,Semester,Class,Cour...

CVE-2025-64512-Polyglot-PoC

CVE-2025-64512 Polyglot Payload In the last weeks in November 2025, an interesting vulnerability CVE-2025-64512 was disclosed in pdfminer.six, a popular Python project to process PDF files, used in particular in AI pipelines. The vulnerability enables remote code execution by deserializing...

CVE-2024-4367-hands-on-01

!IMPORTANT This repository is for learning about vulnerabilities. Perform this hands-on only on an appropriate computer that you manage. Never engage in illegal activities. The author accepts no responsibility or liability for any damage arising from this repository. CVE-2024-4367-hands-on A...

CVE-2024-4367

CVE-2024-4367 POC Usage python poc.py mal.pdf "alert'0xr2r'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC scaner templates...

Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 Stored XSS CMS Stored XSS Vulnerability PoC Overview This repository demonstrates a Stored XSS vulnerability found in the Wagtail 6.4.1 CMS platform. A malicious JavaScript is embedded in a PDF file, and every time a user clicks on the PDF, a...

WebAuthn Component DoS

The WebAuthn component vulnerability in Google Chrome and Microsoft Edge web browsers is related to insufficient validation of user-supplied protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted PDF file...

Google Chrome Microsoft Edge DoS

The vulnerability in the Notifications component of Google Chrome and Microsoft Edge web browsers is related to insufficient validation of input protected information. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted PDF fi...

InterestGroups Component Compromise Protected Information

The vulnerability in the InterestGroups component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted PDF file...

SiteIsolation Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the SiteIsolation component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted PDF file...

LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Poppler

A vulnerability was discovered in the freedesktop Poppler version 20.12.1. This vulnerability allows remote attackers to trigger a Denial-of-Service DoS attack through a crafted .pdf file, targeting the FoFiType1C::cvtGlyph function...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the “Save to Drive” function in Google Chrome before version 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

RHLW-2026-4F7C55B876854238 Lightwell Security Advisory: fontbox 2.0.19.rhlw-00001

Red Hat Lightwell has released org.apache.pdfbox:fontbox 2.0.19.rhlw-00001 with a backported security fix. CVE-2021-27807: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. This patched...