Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: dompdf/dompdf 2.0.0 Clear all filters
TI-2021-02812 CVE-2021-3902 · GHSA-3vjh-xrhf-v9xh

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Priority HIGH 82

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00951 Published 2024-11-15 Fixed in 2.0.0 CWE-611
TI-2021-02769 CVE-2021-3838 · GHSA-577p-7j7h-2jgf

PHAR Deserialization in dompdf/dompdf

Priority HIGH 82

DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01432 Published 2024-11-15 Fixed in 2.0.0 CWE-502