CVE-2025-49289

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.5.0...

CVE-2025-49289 WordPress PDF for WPForms <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.5.0...

CVE-2025-49289 WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through = 5.5.0...

CVE-2025-49289

CVE-2025-49289 is a Missing Authorization vulnerability in the PDF for WPForms (WordPress plugin) that affects the PDF for WPForms component up to version 5.5.0. The issue is rooted in improperly configured access control, allowing unauthorized users to access or manipulate PDF-related functional...

WordPress plugin PDF for WPForms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

PT-2025-24224 · Wpforms · Pdf For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF for WPForms versions 5.5.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited through the add-ons.or...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin PDF for WPForms versions = 5.5.0...

ALSA-2025:8421 Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: Ghostscript: NPDL device: Compression buffer overflow CVE-2025-27832 For more details...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

CVE-2025-20297 Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint th...

CVE-2025-20297 Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint th...

CVE-2025-20297

Vulnerability CVE-2025-20297 affects Splunk Enterprise before 9.4.2, 9.3.4, and 9.2.6, and Splunk Cloud Platform before 9.3.2411.102, 9.3.2408.111, and 9.2.2406.118. A low-privileged user can craft a payload via the pdfgen/render REST endpoint, potentially executing unauthorized JavaScript in a u...

[SECURITY] [DLA 4205-1] libreoffice security update

Debian LTS Advisory DLA-4205-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert June 01, 2025 https://wiki.debian.org/LTS Package : libreoffice Version : 1:7.0.4-4+deb11u13 CVE ID : CVE-2025-1080 CVE-2025-2866 Multiple vulnerabilities were discovered in Libreoffice,...

Debian dla-4205 : fonts-opensymbol - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4205 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4205-1 [email protected]...

Foxit PDF Reader Memory Corruption Vulnerability

Foxit PDF Reader is a software for reading and working with PDF documents. A memory corruption vulnerability exists in Foxit PDF Reader. The vulnerability stems from an out-of-bounds write to the native library when attempting PDF rendering, resulting in memory corruption. An attacker can exploit...

thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to...

CVE-2024-51392

An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component...

Updated ghostscript packages fix security vulnerabilities

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708...

MGASA-2025-0170 Updated ghostscript packages fix security vulnerabilities

gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708...