Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-63917

Good to know:

icon

Date: November 16, 2025

PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-63917
https://www.cnblogs.com/pdfpatcher
https://github.com/cydtseng/Vulnerability-Research/blob/main/pdfpatcher/XXE-Importers.md
https://github.com/wmjordan/PDFPatcher
https://www.mend.io/vulnerability-database/CVE-2025-63917

Severity Score

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference

CWE-611

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us