Skip to content

TCPDF missing character escape on error messages

Moderate severity GitHub Reviewed Published Dec 27, 2024 to the GitHub Advisory Database • Updated Dec 27, 2024

Package

composer tecnickcom/tcpdf (Composer)

Affected versions

< 6.8.0

Patched versions

6.8.0

Description

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

References

Published by the National Vulnerability Database Dec 27, 2024
Published to the GitHub Advisory Database Dec 27, 2024
Reviewed Dec 27, 2024
Last updated Dec 27, 2024

Severity

Moderate

Weaknesses

CVE ID

CVE-2024-56527

GHSA ID

GHSA-qx95-cwh6-9mvq

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.