Skip to content
OpenAdvisories

Vendor

alam00000

4 known vulnerabilities.

Products

bentopdf 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2026-77581

    BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass

    BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution us…

    alam00000 bentopdf
  • High 7.0
    CVE-2026-41653 Public exploit

    BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

    BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This…

    alam00000 bentopdf