Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
"CVE-2024–25180 Walkthrough (Proving Ground-OSCP)" by Cyber Public School #BugBounty #Cybersecurity #Hacking #InfoSec https://medium.com/@cyber_public_school/cve-2024-25180-walkthrough-proving-ground-oscp-76a277467e77
Post summary
The post promotes a Medium walkthrough demonstrating a proof of concept for CVE‑2024‑25180, but it lacks concrete exploit code, active‑use evidence, patches, or technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pdfmake_project | pdfmake | 0.2.9 | - | - |