Phantompdf
Vendor:
First CVE: Mar 30, 2015 · Active for 11 years
558
Total CVEs
More Total CVEs than 86% of tracked products
69.8
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
8.0
Avg CVSS
Higher Avg CVSS than 42% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Phantompdf over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 30, 2015
11 years ago
Most Recent CVE
Aug 29, 2022
1,425 days ago
CVE Severity & Scoring
Phantompdf558 CVEs
13%
80%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local164 (29.4%)
Network390 (69.9%)
Unknown4 (0.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low543 (97.3%)
High11 (2.0%)
Unknown4 (0.7%)
User Interaction
None79 (14.2%)
Unknown4 (0.7%)
Required475 (85.1%)
Privileges Required
Low4 (0.7%)
High0 (0.0%)
None550 (98.6%)
Unknown4 (0.7%)
Top CVEs
Signals from CVEs in this product scope (558 CVEs).
558 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-9958HIGH This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerabil | May 17, 2018 | 8.8 | 79 | NO | YES |
CVE-2018-9948MEDIUM This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this v | May 17, 2018 | 6.5 | 75 | NO | YES |
CVE-2018-3956HIGH An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Software's PDF Reader version 9.1.0.5096. A specially crafted PDF | Jan 30, 2019 | 7.1 | 49 | NO | NO |
CVE-2018-3924HIGH An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF document can trigger a pr | Aug 1, 2018 | 7.8 | 49 | NO | NO |
CVE-2020-8844HIGH This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerabili | Feb 14, 2020 | 7.8 | 37 | NO | NO |
CVE-2020-8856HIGH This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerab | Feb 14, 2020 | 7.8 | 35 | NO | NO |
CVE-2020-8846HIGH This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerab | Feb 14, 2020 | 7.8 | 35 | NO | NO |
CVE-2018-14442CRITICAL Foxit Reader before 9.2 and PhantomPDF before 9.2 have a Use-After-Free that leads to Remote Code Execution, aka V-88f4smlocs. | Jul 20, 2018 | 9.8 | 33 | NO | NO |
CVE-2018-21242CRITICAL An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action. | Jun 4, 2020 | 9.8 | 32 | NO | NO |
CVE-2020-8845HIGH This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerab | Feb 14, 2020 | 7.8 | 32 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (558 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
2 CVEs
0.4% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
0.7% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (558 CVEs).
Media Mentions
Signals from CVEs in this product scope (558 CVEs).
Top CNAs Publishing CVEs For Phantompdf
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.6.0.25114 | 6 | 8.1 | 5.2% | 0 | 0 |
| 9.5.0.20723 | 4 | 7.8 | 6.1% | 0 | 0 |
| 8.3.9 | 1 | 5.3 | 1.1% | 0 | 0 |
| 8.1.1.1115 | 1 | 8.1 | 3.8% | 0 | 0 |
| 7.1.0.306 | 1 | 5.0 | 2.7% | 0 | 0 |