What’s Vulnerable › Vulnerabilities

CVE-2023-39062

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-28 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.

Affected products

• Html2Pdf Project Html2Pdf: before 5.2.8 — fixed in 5.2.8

How to fix

Upgrade to a fixed version: Html2Pdf Project Html2Pdf 5.2.8. Check the vendor advisory for mitigations.

References

• https://github.com/afine-com/CVE-2023-39062
• https://github.com/sectroyer/CVEs/tree/main/CVE-2023-39062
• https://github.com/spipu/html2pdf/blob/92afd81823d62ad95eb9d034858311bb63aeb4ac/CHANGELOG.md
• https://github.com/afine-com/CVE-2023-39062
• https://github.com/sectroyer/CVEs/tree/main/CVE-2023-39062
• https://github.com/spipu/html2pdf/blob/92afd81823d62ad95eb9d034858311bb63aeb4ac/CHANGELOG.md

Get alerted when CVE-2023-39062 or the next vulnerability affects your stack