Apryse develops document-processing and web-viewing libraries such as HTML2PDF and WebViewer that handle user-supplied or remote content in browser and server contexts, presenting a supply-chain dependency across integration points. The recurring vulnerability patterns center on input-handling and content-processing weaknesses—cross-site scripting, OS command injection, and server-side request forgery—that are characteristic of tools bridging web and document formats. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Apryse over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-56590CRITICAL An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system comm | Jan 22, 2026 | 9.8 | 36 | NO | NO |
CVE-2025-56589HIGH A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These v | Jan 22, 2026 | 7.5 | 30 | NO | NO |
CVE-2024-57240MEDIUM A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execute arbitrary code via a crafted PDF file | Mar 3, 2025 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Apryse.
Media articles that mention a CVE ID that affects a product developed by Apryse — matched by CVE ID, not by vendor name.