Vulnerability-Lookup - Search a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVE-2025-14405 (GCVE-0-2025-14405)

Vulnerability from nvd – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Summary

PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867.

Severity ?

6.6 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:24.898Z",
      "datePublic": "2025-12-11T20:58:56.680Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:23.722Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1093",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1093/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Xavier DANEST"
      },
      "title": "PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14405",
    "datePublished": "2025-12-23T21:21:23.722Z",
    "dateReserved": "2025-12-10T01:37:24.865Z",
    "dateUpdated": "2025-12-23T21:21:23.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14401 (GCVE-0-2025-14401)

Vulnerability from nvd – Published: 2025-12-23 21:20 – Updated: 2025-12-23 21:20

Title

PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability

Summary

PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260.

Severity ?

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:10.228Z",
      "datePublic": "2025-12-11T20:58:26.137Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:20:22.912Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1089",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1089/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "rgod"
      },
      "title": "PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14401",
    "datePublished": "2025-12-23T21:20:22.912Z",
    "dateReserved": "2025-12-10T01:37:10.209Z",
    "dateUpdated": "2025-12-23T21:20:22.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14403 (GCVE-0-2025-14403)

Vulnerability from nvd – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500.

Severity ?

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:16.913Z",
      "datePublic": "2025-12-11T20:58:41.335Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:15.464Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1091",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1091/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14403",
    "datePublished": "2025-12-23T21:21:15.464Z",
    "dateReserved": "2025-12-10T01:37:16.892Z",
    "dateUpdated": "2025-12-23T21:21:15.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14402 (GCVE-0-2025-14402)

Vulnerability from nvd – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27499.

Severity ?

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:13.594Z",
      "datePublic": "2025-12-11T20:58:35.480Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27499."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:10.806Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1090",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1090/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14402",
    "datePublished": "2025-12-23T21:21:10.806Z",
    "dateReserved": "2025-12-10T01:37:13.574Z",
    "dateUpdated": "2025-12-23T21:21:10.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14404 (GCVE-0-2025-14404)

Vulnerability from nvd – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498.

Severity ?

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:20.322Z",
      "datePublic": "2025-12-11T20:58:48.004Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:19.483Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1092",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1092/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14404",
    "datePublished": "2025-12-23T21:21:19.483Z",
    "dateReserved": "2025-12-10T01:37:20.278Z",
    "dateUpdated": "2025-12-23T21:21:19.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14405 (GCVE-0-2025-14405)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Summary

PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867.

Severity ?

6.6 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:24.898Z",
      "datePublic": "2025-12-11T20:58:56.680Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:23.722Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1093",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1093/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Xavier DANEST"
      },
      "title": "PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14405",
    "datePublished": "2025-12-23T21:21:23.722Z",
    "dateReserved": "2025-12-10T01:37:24.865Z",
    "dateUpdated": "2025-12-23T21:21:23.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14404 (GCVE-0-2025-14404)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498.

Severity ?

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:20.322Z",
      "datePublic": "2025-12-11T20:58:48.004Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:19.483Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1092",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1092/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14404",
    "datePublished": "2025-12-23T21:21:19.483Z",
    "dateReserved": "2025-12-10T01:37:20.278Z",
    "dateUpdated": "2025-12-23T21:21:19.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14403 (GCVE-0-2025-14403)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500.

Severity ?

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:16.913Z",
      "datePublic": "2025-12-11T20:58:41.335Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:15.464Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1091",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1091/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14403",
    "datePublished": "2025-12-23T21:21:15.464Z",
    "dateReserved": "2025-12-10T01:37:16.892Z",
    "dateUpdated": "2025-12-23T21:21:15.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14402 (GCVE-0-2025-14402)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:21 – Updated: 2025-12-23 21:21

Title

PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27499.

Severity ?

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:13.594Z",
      "datePublic": "2025-12-11T20:58:35.480Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27499."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:10.806Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1090",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1090/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14402",
    "datePublished": "2025-12-23T21:21:10.806Z",
    "dateReserved": "2025-12-10T01:37:13.574Z",
    "dateUpdated": "2025-12-23T21:21:10.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14401 (GCVE-0-2025-14401)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:20 – Updated: 2025-12-23 21:20

Title

PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability

Summary

PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260.

Severity ?

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

zdi

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-…

x_research-advisory

Impacted products

	Vendor	Product	Version
	PDFsam	Enhanced	Affected: 7.0.76.15222

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:10.228Z",
      "datePublic": "2025-12-11T20:58:26.137Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:20:22.912Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1089",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1089/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "rgod"
      },
      "title": "PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14401",
    "datePublished": "2025-12-23T21:20:22.912Z",
    "dateReserved": "2025-12-10T01:37:10.209Z",
    "dateUpdated": "2025-12-23T21:20:22.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Search criteria

10 vulnerabilities found for Enhanced by PDFsam

CVE-2025-14405 (GCVE-0-2025-14405)

CVE-2025-14401 (GCVE-0-2025-14401)

CVE-2025-14403 (GCVE-0-2025-14403)

CVE-2025-14402 (GCVE-0-2025-14402)

CVE-2025-14404 (GCVE-0-2025-14404)

CVE-2025-14405 (GCVE-0-2025-14405)

CVE-2025-14404 (GCVE-0-2025-14404)

CVE-2025-14403 (GCVE-0-2025-14403)

CVE-2025-14402 (GCVE-0-2025-14402)

CVE-2025-14401 (GCVE-0-2025-14401)