CVE-2024-56521

An issue exists in TCPDF versions prior to 6.8.0 where the software unsafely sets CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER when libcurl is used. This improper certificate validation (CWE-295) can lead to critical security risks. While the vulnerability is present in several Linux distrib...

CVE-2024-56527

The TCPDF PHP library (versions before 6.8.0 ) contains a vulnerability where the Error() function fails to use htmlspecialchars when processing error messages. This insufficient cleansing of user-supplied data during web page generation can allow a remote attacker to execute arbitrary code . Rem...

CVE-2024-32489

The TCPDF PHP library, a tool for generating PDF files on-the-fly, contains a vulnerability where it mishandles calls using HTML syntax . Specifically, the library fails to properly cleanse or remove script-related HTML tags , which can allow a malicious actor to perform cross-site scripting (XSS...

CVE-2024-22641

The TCPDF PHP library (versions <= 6.7.4 or

CVE-2024-22640

The TCPDF PHP library (version

CVE-2024-56519

The TCPDF PHP library, used for generating PDF documents, is vulnerable because the setSVGStyles function fails to sanitize the SVG font-family attribute. This lack of proper input validation allows an attacker to perform cross-site scripting (XSS) attacks remotely. Remediation is available throu...

CVE-2024-56522

The TCPDF PHP library, used for generating PDF documents, is vulnerable to security bypasses because the unserializeTCPDFtag() function fails to use a constant-time function when comparing TCPDF tag hashes. Instead, it utilizes loose comparison (!= ), which can be exploited by a remote attacker t...

CVE-2024-51058

The TCPDF PHP library (specifically version 6.7.5 ) is vulnerable to a Local File Inclusion (LFI) flaw. An attacker can exploit this by using the tag to read arbitrary files from the server's file system, which may result in the disclosure of confidential information . To remediate this on Debia...

CVE-2017-6100

CVE-2017-6100 affects TCPDF prior to 6.2.0. The vulnerability is a local file inclusion flaw that enables the server to upload PDF-generated files to an external FTP server. Reported behavior across sources consistently notes that versions before 6.2.0 are impacted; a fix is to upgrade to 6.2.0 o...