CVE-2025-10647 Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload

The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxhandlerdownloadpdfmedia function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2025-10647

The CVE-2025-10647 entry refers to the WordPress plugin Embed PDF for WPForms. Affected versions are

CVE-2025-10647 Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload

The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxhandlerdownloadpdfmedia function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress Embed PDF for WPForms plugin <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by theviper17y in WordPress Plugin Embed PDF for WPForms versions = 1.1.5...

Autodesk Revit 2024 < 2024.3.4 / 2025 < 2025.4.3 / 2026 < 2026.3 Multiple Vulnerabilities (adsk-sa-2025-0018)

The version of Autodesk Revit installed on the remote host is 2024 prior to 2024.3.4, 2025 prior to 2025.4.3, or 2026 prior to 2026.3. It is, therefore, affected by multiple vulnerabilities as referenced in the adsk-sa-2025-0014 advisory: - A maliciously crafted PDF file, when parsed through...

Exploit for CVE-2010-1240

CVE-2010-1240 PDF Launch Action Research Tool !Pythonhttps...

XML External Entity Injection (XXE)

org.apache.tika, tika-parser-pdf-module is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of crafted XFA files inside PDFs, which allows an attacker to read sensitive data or trigger malicious requests to internal or third-party servers...

CVE-2025-8894

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-8894 PDF File Parsing Heap-Based Buffer Overflow Vulnerability

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-8893 PDF File Parsing Out-of-Bounds Write Vulnerability

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2025-8893 PDF File Parsing Out-of-Bounds Write Vulnerability

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

CVE-2025-8893

CVE-2025-8893 describes an Out-of-Bounds Write in Autodesk products triggered by parsing a malicious PDF. The issue affects Autodesk software that processes PDFs; root cause is a vulnerability in PDF parsing potentially allowing a local attacker to crash, corrupt data, or execute arbitrary code i...

Security Bulletin: IBM ICCSAP cross site scripting vulnerablity fix.

Summary Vulnerability were disclosed part of Cross Site Scripting With PDF Vulnerability Details CVEID:CVE-2024-4367 DESCRIPTION: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126,...

PT-2025-38000

Name of the Vulnerable Software and Affected Versions Autodesk products affected versions not specified Description A maliciously crafted PDF file, when parsed, can trigger a Heap-Based Overflow. Successful exploitation could lead to a crash, sensitive data disclosure, or arbitrary code execution...

MAL-2025-47171 Malicious code in @triniwiz/nativescript-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dee524a059c5be768ba0f921b02cf030608c6377823ec2fda73727e66313248 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @triniwiz/nativescript-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dee524a059c5be768ba0f921b02cf030608c6377823ec2fda73727e66313248 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-58978

Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through = 1.5.4...

GHSA-9MV7-3C64-MMQW xml2rfc is vulnerable to arbitrary file reads through prepped files

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...

UPDF 代码问题漏洞

UPDF is a multi-platform PDF editor from the Chinese company UPDF. A code issue vulnerability exists in UPDF version 1.8.5.0, which stems from DLL search path hijacking and could lead to the execution of arbitrary code...

ROS-20250910-03

Vulnerability of Poppler PDF rendering library is related to lack of object threads cleanup PDF when cairodebugresetstaticdata is called. Exploitation of the vulnerability could allow an attacker to gain access to confidential information...