CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.

• CWE-611

• https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.htmlThird Party Advisory
• https://www.pdfreactor.com/important-pdfreactor-security-advisory/Vendor Advisory
• https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/Release Notes, Vendor Advisory
• https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.htmlThird Party Advisory
• https://www.pdfreactor.com/important-pdfreactor-security-advisory/Vendor Advisory
• https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/Release Notes, Vendor Advisory

Published

Jun 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12147The Sangoma Session Border Controller (SBC) 2.3.23-119 GA we…9.8
• CVE-2019-12148The Sangoma Session Border Controller (SBC) 2.3.23-119 GA we…9.8
• CVE-2019-12149SQL injection vulnerability in silverstripe/restfulserver mo…
• CVE-2019-1215An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-12150Karamasoft UltimateEditor 1 does not ensure that an uploaded…
• CVE-2019-12153Lack of validation in the HTML parser in RealObjects PDFreac…
• CVE-2019-12155interface_release_resource in hw/display/qxl.c in QEMU 3.1.x…
• CVE-2019-12156Server metadata could be exposed because one of the error me…5.3
• CVE-2019-12157In JetBrains UpSource versions before 2018.2 build 1293, the…9.8
• CVE-2019-12158GoHTTP through 2017-07-25 has a GetExtension heap-based buff…
• CVE-2019-12159GoHTTP through 2017-07-25 has a stack-based buffer over-read…
• CVE-2019-1216An information disclosure vulnerability exists when DirectX …5.5