research-labs

Laboratorios de investigadores Este repositorio contiene una serie de aplicaciones intencionalmente vulnerables que puedes utilizar para explorar vulnerabilidades descubiertas por PortSwigger Research. Ten en cuenta que puedes encontrar muchos laboratorios en línea gratuitos diseñados por...

CVE-2024-4367-hands-on

!IMPORTANT Este repositorio está destinado al aprendizaje de vulnerabilidades. Este taller práctico debe realizarse exclusivamente en un ordenador bajo su control. No realice ninguna actividad ilegal. Además, el autor no se hace responsable de ningún daño o responsabilidad derivados de este...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1775817651)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775817651 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 3...

POC-CVE-2026-19626

CVE-2026-19626 — RCE en la generación de informes autenticado, no administrador Estado: CONFIRMADO — totalmente remoto, no administrador, solo REST laboratorio 6.7.2-14.el9, 2026-08-21. La cadena armada esto es lo que hace poc.py: 1. inicia sesión como cualquier usuario normal de la organización ...

CVE-2026-91794

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-91794 Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-91794 Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

EUVD-2026-85128

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-91794

Foxit PDF Editor/Reader is vulnerable to an out-of-bounds write vulnerability within its PDF rendering process . The issue is caused by insufficient consistency and boundary validation when the software processes malformed color space data . This flaw could allow an attacker to cause a program cr...

PT-2026-97213

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An out-of-bounds write occurs during the PDF rendering process due to insufficient consistency and boundary validation when processing malformed color space data. This flaw ca...

CVE-2026-91794: Out-of-bounds Write

An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution...

CVE-2026-49865

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

EUVD-2026-70735

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-79119

Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: Low...

Unity Linux 20.1070a Security Update: poppler (UTSA-2026-099553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099553 advisory. A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an...

CVE-2026-69078

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-69078

CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...

CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...