Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
Tcpdf Project records in CISA KEVNo Tcpdf Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority HIGH 72
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01113 · Published 2024-05-28 · No fix listed CWE-434
Priority MEDIUM 50
An issue was discovered in TCPDF before 6.8.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00785 · Published 2024-12-27 · Fixed in 6.8.0 CWE-295
Priority MEDIUM 42
TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01325 · Published 2024-04-19 · Fixed in 6.7.5 CWE-1333
Priority MEDIUM 40
An issue was discovered in TCPDF before 6.8.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00762 · Published 2024-12-27 · Fixed in 6.8.0 CWE-79
Priority MEDIUM 40
An issue was discovered in TCPDF before 6.8.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00614 · Published 2024-12-27 · Fixed in 6.8.0 CWE-843
Priority MEDIUM 40
An issue was discovered in TCPDF before 6.8.0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00623 · Published 2024-12-27 · Fixed in 6.8.0 CWE-79
Priority LOW 36
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.0146 · Published 2017-02-23 · No fix listed CWE-668
Priority LOW 29
Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00812 · Published 2024-11-26 · Fixed in 6.7.6 CWE-552
Priority LOW 28
TCPDF before 6.7.4 mishandles calls that use HTML syntax.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00582 · Published 2024-04-15 · Fixed in 6.7.4 CWE-80
THREATIST.IORead the docs