research-labs

연구자의 랩 이 저장소에는 PortSwigger Research가 발견한 취약점을 탐색하는 데 사용할 수 있는 의도적으로 취약하게 만든 여러 애플리케이션이 포함되어 있습니다. 참고로 Web Security Academy에서 PortSwigger Research가 설계한 많은 무료 온라인 랩을 찾을 수 있습니다. 목차 SignSaboteur 웹 토큰 서명기 브라우저 PDF 렌더링 차이 ASCII 제어 문자 명령 주입 경고 이 랩을 실행하면 로컬 머신에 취약한 웹사이트가 생성됩니다. 이러한 웹사이트를 다른 시스템에 노출하면 해킹당...

CVE-2024-4367-hands-on

!IMPORTANT 本リポジトリは、脆弱性を学習するためのものです。 本ハンズオンは、必ず自分の管理する適切なコンピュータで行ってください。違法行為は絶対に行わないでください。 また本リポジトリによって発生した、一切の損害・責任を、作者は負いません。 CVE-2024-4367-hands-on CVE-2024-4367を体験するハンズオン poc.pdfの作成 root@kitploit: python CVE-2024-4367-PoC/CVE-2024-4367.py "alert'document.domain'"...

POC-CVE-2026-19626

CVE-2026-19626 — 보고서 생성 과정의 RCE 인증된 비관리자 상태: 확인됨 — 순수 원격, 비관리자, REST 전용 6.7.2-14.el9 랩, 2026-08-21. 무기화된 공격 체인 poc.py가 수행하는 작업: 1. 일반 조직 사용자로 로그인 2. POST /rest/group 요청에 name: "=system''" 포함 — 중괄호/따옴표가 그대로 허용됨 그룹 컨트롤러에는 문자셋 검사가 없음 3. POST /rest/reportDefinition — PDF 보고서, pieChart 컴포넌트 하나,...

EUVD-2026-70735

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-79119

Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: Low...

CVE-2026-69078

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078

CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...

CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

Linux Distros Unpatched Vulnerability : CVE-2026-59941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header...

UBUNTU-CVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

Уязвимость функции tilingPatternFill библиотеки для отображения PDF-файлов Poppler, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции tilingPatternFill библиотеки для отображения PDF-файлов Poppler связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Denial Of Service (DoS)

dompdf/dompdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper resource consumption controls during the PDF rendering phase after image dimension validation, which allows an unauthenticated attacker to submit a specially crafted HTML document containing a large...

CVE-2026-8661

Server-Side Request Forgery in the markdowntopdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements img/src, CSS url, @import embedded in Markdown input...

Important: Red Hat Security Advisory: poppler security update

An update for poppler is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Cross-site Scripting (XSS)

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Cross-site Scripting XSS via the PDF rendering process. An attacker can cause the server to make arbitrary HTTP requests and potentially leak internal network information by injecti...

CVE-2026-57535

Content injected to PDF rendering contexts could, in many places, include HTML content including tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server a...