CVE Feed

    Dashboard / CVE / CVE-2024-56522

    CVE-2024-56522

    An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.

    Published:Dec 27, 2024
    Last Modified:Nov 3, 2025
    EPS:Dec 27, 2024
    EPSS Score:0.00221
    CVSS Score:7.5

    Affected Products

    Vendor
    Tcpdf Project
    Product
    Tcpdf

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-56521 (CVSS 9.8) — An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERI…
    CVE-2024-56527 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error…
    CVE-2024-56519 (CVSS 7.5) — An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.…
    CVE-2024-51058 (CVSS 6.2) — Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user…
    CVE-2024-22641 (CVSS 7.5) — TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an unt…
    CVE-2024-22640 (CVSS 7.5) — TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HT…
    CVE-2024-32489 (CVSS 6.1) — TCPDF before 6.7.4 mishandles calls that use HTML syntax.…
    CVE-2017-6100 (CVSS 7.5) — tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High