| Package | Affected versions | Patched versions |
|---|---|---|
| pdfpatcher | ≤ 1.1.3.4663 |
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free