CVE Feed

    Dashboard / CVE / CVE-2024-32489

    CVE-2024-32489

    TCPDF before 6.7.4 mishandles calls that use HTML syntax.

    Published:Apr 15, 2024
    Last Modified:Nov 3, 2025
    EPS:Apr 15, 2024
    EPSS Score:0.00199
    CVSS Score:6.1

    Affected Products

    Vendor
    Tcpdf Project
    Product
    Tcpdf

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-56521 (CVSS 9.8) — An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERI…
    CVE-2024-56522 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not…
    CVE-2024-56527 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error…
    CVE-2024-56519 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.…
    CVE-2024-51058 (CVSS 6.2) — Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user…
    CVE-2024-22641 (CVSS 7.5) — TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an unt…
    CVE-2024-22640 (CVSS 7.5) — TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HT…
    CVE-2017-6100 (CVSS 7.5) — tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High