CVE-2024-25180

CVE-2024-25180 Overview pdfmake is a pure JavaScript client/server PDF printing library. The affected versions of this package are vulnerable to arbitrary code injection. An attacker can execute arbitrary code by sending a crafted POST request to the /pdf path. The attacker can execute arbitrary...

Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 XSS almacenado Vulnerabilidad PoC de XSS almacenado en CMS Resumen Este repositorio demuestra una vulnerabilidad de XSS almacenado encontrada en la plataforma Wagtail 6.4.1 CMS. Se incrusta un JavaScript malicioso en un archivo PDF, y cada ve...

writehat

WriteHat es una herramienta de informes que elimina Microsoft Word y muchas horas de sufrimiento del proceso de generación de informes. Markdown -- HTML -- PDF. Creada por probadores de penetración, para probadores de penetración, pero puede usarse para generar cualquier tipo de informe. Escrito...

CVE-2024-4367

CVE-2024-4367 POC Usage python poc.py mal.pdf "alert'0xr2r'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js POC scaner templates...

-Foxit-PDF-CVE-2023-27363-

This repository does not have a README...

CVE-2025-46206

There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the stripoutlines and stripoutline functions in pdf-clean-file.c until the stack is exhausted...

CVE-2019-14811-in-pdf-exploit

CVE-2019-14811 GhostScript PDF preview Exploit PoC This exploit targets CVE-2019-14811 in GS environments where PostScript output is not reflected, but is executed such as PDF previews via png images. Exploit renders commands directly in pngXXm preview, it is based on...

CVE-2026-108850

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

EUVD-2026-97001

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

CVE-2026-108850

The Company Research Agent software (versions through 2.2.0 ) is vulnerable to a server-side request forgery (SSRF) via the /generate-pdf endpoint. The root cause is the injection of unescaped ReportLab paragraph markup into the report_content parameter. Unauthenticated attackers can embed inline...

CVE-2024-4367-POC

CVE-2024-4367 POC Usage python poc.py malicious.pdf "alert'S4vvy'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js...

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Usage python CVE-2024-9935.py http://example.com...

CVE-2023-38831_ReverseShell_Winrar

CVE-2023-38831 In this case, I share the necessary files to exploit this vulnerability in WinRAR, with which we can create a malicious PDF to establish a reverse shell to our attacker machine. ⚠️ NOTE: This content is shared for ethical purposes and is created to practice in controlled environment...

cve-2018-15968

Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability Vulnerability Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Vulnerability Description This vulnerability allows remote attackers to disclose sensitive information on vulnerable installatio...

webvulscan

WebVulScan Sinopsis WebVulScan es un escáner de vulnerabilidades de aplicaciones web. Es una aplicación web escrita en PHP que se puede utilizar para probar aplicaciones web remotas o locales en busca de vulnerabilidades de seguridad. Mientras se ejecuta un escaneo, los detalles del escaneo se...

CVE-2025-50422

Poppler before version 25.04.0 When pdftocairo renders a malicious PDF and calls cairodebugresetstaticdata on exit, heap memory containing PDF object streams is not properly cleared. An attacker with local access can dump process memory and recover clear-text PDF content e.g., /stream /endstream...

Uncontrolled Search Path Element

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Uncontrolled Search Path Element

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...