Skip to content
OpenAdvisories

Package · Packagist

dompdf/dompdf

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-23924 Public exploit

    URI validation failure on SVG parsing in Dompdf

    Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…

    dompdf dompdf dompdf/dompdf Packagist
  • Critical 9.8
    CVE-2022-28368 Public exploit EPSS 84%

    Remote code injection in dompdf/dompdf

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

    dompdf/dompdf Packagist