Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

POC-CVE-2025-54988

CVE-2025-54988 - POC Disclaimer: I am not the original discoverer of this vulnerability. This post documents my process of reproducing the issue in a controlled environment for educational purposes and to help others validate their own systems. The tests were conducted in an isolated lab with no...

CVE-2021-45067

CVE-2021-45067 This bug was Out of Bounds Read caused by treating ANSI string as Unicode which can be exploited to leak sensitive information from the sandboxed adobe reader process. Blog Adobe Reader - XFA - ANSI - Unicode Confusion Information Leak Advisory CVE-2021-45067 Demo...

CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0  by vulnerabilities in Apache Tika PDF parser module

Summary IBM Optim versions 1.0.0 and 1.1.0 include open-source package Apache Tika that is affected by a critical vulnerability. IBM Optim 1.2.0 resolves this vulnerability by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-54988 DESCRIPTION:...

HTTP Request Smuggling

Overview ngx-extended-pdf-viewer is a powerful, full-featured PDF viewer for Angular applications. Whether you're building enterprise tools or internal utilities, this library gives you the control and customization options you need, all while preserving a native-like viewing experience. Built on...

GHSA-W9HM-4M3M-FXMM ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. Impact Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream...

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. Impact Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. Upstream...

XML External Entity (XXE) Injection

veraPDF-validation is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper processing of external entities in a malicious XFA stream within a crafted PDF during PDF/UA-1 validation, which allows an attacker to disclose local files or make outbound server-side...

GHSA-36MM-W85J-3Q2J veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

EUVD-2026-50368

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

CVE-2026-54079: Improper Restriction of XML External Entity Reference

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

PYSEC-2026-3027 pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...

PT-2026-59649

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...

PDF CVE-2025-66516 Tika XFA OOB XXE

Generate PDF PoC for CVE-2025-66516: blind OOB XXE via parameter entity in XFA targeting Apache Tika Confluence, Jira, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writetikaxfaxxeoob class...

PDF CVE-2017-9096 XXE XFA Form

Generate PDF PoC for CVE-2017-9096: XXE in AcroForm /XFA XML stream for server-side PDF processors. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexfaacroform class ModuleAuxiliary, PdfCveMixin:...