Common Weakness Enumeration

CWE-356

Weakness Allowed

Missing User Interaction for Potentially Unsafe Action

Abstraction: Base · Status: Incomplete

The product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-285 · View CWE-1000

PeerOf: CWE-451 (symmetric) · View CWE-1000

Modes of introduction

Architecture and Design

The architecture or design might include a component or potentially dangerous functionality that could effectively act independently.

Implementation

A bug in the implementation could cause the product to fail to recognize that it is about to perform a dangerous operation requiring a human decision.

Notes

Relationship

Often resultant, e.g. in unhandled error conditions.

Relationship

Can overlap privilege errors, conceptually at least.

Content history

Submission: PLOVER · 2006-07-19 · CWE Draft 3

Contribution: Eran Segal · 2025-12-24 · CWE 5.0

Suggested improved coverage of Human-in-the-Loop bypasses in AI systems, leading to updates to this entry.

Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Relationships, Relationship_Notes, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2008-10-14 · CWE 1.0.1

updated Description

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Relationships

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Relationships

49 vulnerabilities reference this CWE, most recent first.

CVE-2026-25805 (GCVE-0-2026-25805)

Vulnerability from cvelistv5 – Published: 2026-02-10 17:27 – Updated: 2026-02-10 19:20

Title

Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.

Summary

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-10 19:19 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/zed-industries/zed/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
zed-industries	zed	Affected: < 0.219.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25805",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T19:19:39.535300Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T19:20:11.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zed",
          "vendor": "zed-industries",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.219.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-10T17:27:49.390Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq"
        }
      ],
      "source": {
        "advisory": "GHSA-f2g4-87h6-4pxq",
        "discovery": "UNKNOWN"
      },
      "title": "Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25805",
    "datePublished": "2026-02-10T17:27:49.390Z",
    "dateReserved": "2026-02-05T19:58:01.641Z",
    "dateUpdated": "2026-02-10T19:20:11.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0777 (GCVE-0-2026-0777)

Vulnerability from cvelistv5 – Published: 2026-02-20 22:11 – Updated: 2026-02-26 14:44

Title

Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability

Summary

Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of attachments. When opening an attachment, the user interface fails to warn the user of unsafe actions. An attacker can leverage this vulnerability to execute code in the context of current user. Was ZDI-CAN-26034.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-25 04:55 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Xmind	Xmind	Affected: 24.10.01101-202410202317

Date Public

2026-02-13 21:40

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0777",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-25T04:55:46.995226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:13.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xmind",
          "vendor": "Xmind",
          "versions": [
            {
              "status": "affected",
              "version": "24.10.01101-202410202317"
            }
          ]
        }
      ],
      "dateAssigned": "2026-01-08T22:50:54.366Z",
      "datePublic": "2026-02-13T21:40:50.560Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of attachments. When opening an attachment, the user interface fails to warn the user of unsafe actions. An attacker can leverage this vulnerability to execute code in the context of current user. Was ZDI-CAN-26034."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-20T22:11:08.647Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-069",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-069/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "AspiringYoungMan"
      },
      "title": "Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-0777",
    "datePublished": "2026-02-20T22:11:08.647Z",
    "dateReserved": "2026-01-08T22:50:54.343Z",
    "dateUpdated": "2026-02-26T14:44:13.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-31334 (GCVE-0-2025-31334)

Vulnerability from cvelistv5 – Published: 2025-04-03 05:27 – Updated: 2025-04-03 13:52

Summary

Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.

Severity

6.8 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-03 13:51 UTC

CWE

CWE-356 - Product UI does not warn user of unsafe actions

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 189 records in the last 180 days details

References

2 references

URL	Tags
https://www.win-rar.com/start.html?&L=0
https://jvn.jp/en/jp/JVN59547048/

Impacted products

1 product

Vendor	Product	Version
RARLAB	WinRAR	Affected: prior to 7.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31334",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T13:51:57.341675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T13:52:45.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WinRAR",
          "vendor": "RARLAB",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 7.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Issue that bypasses the \"Mark of the Web\" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "Product UI does not warn user of unsafe actions",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-03T05:27:32.538Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.win-rar.com/start.html?\u0026L=0"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN59547048/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-31334",
    "datePublished": "2025-04-03T05:27:32.538Z",
    "dateReserved": "2025-03-27T23:41:26.316Z",
    "dateUpdated": "2025-04-03T13:52:45.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-14418 (GCVE-0-2025-14418)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:22 – Updated: 2025-12-30 21:21

Title

pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27502.

Severity

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-30 21:21 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
pdfforge	PDF Architect	Affected: 9.1.74.23030

Date Public

2025-12-11 20:36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T21:21:11.575775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T21:21:18.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PDF Architect",
          "vendor": "pdfforge",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.74.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:40:54.615Z",
      "datePublic": "2025-12-11T20:36:15.291Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27502."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:22:46.165Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1075",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1075/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14418",
    "datePublished": "2025-12-23T21:22:46.165Z",
    "dateReserved": "2025-12-10T01:40:54.592Z",
    "dateUpdated": "2025-12-30T21:21:18.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14417 (GCVE-0-2025-14417)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:22 – Updated: 2025-12-30 21:20

Title

pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability

Summary

pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27501.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-30 21:20 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
pdfforge	PDF Architect	Affected: 9.1.74.23030

Date Public

2025-12-11 20:36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14417",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T21:20:53.382291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T21:20:58.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PDF Architect",
          "vendor": "pdfforge",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.74.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:40:49.720Z",
      "datePublic": "2025-12-11T20:36:08.813Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27501."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:22:39.324Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1074",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1074/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14417",
    "datePublished": "2025-12-23T21:22:39.324Z",
    "dateReserved": "2025-12-10T01:40:49.204Z",
    "dateUpdated": "2025-12-30T21:20:58.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14416 (GCVE-0-2025-14416)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:22 – Updated: 2025-12-30 21:20

Title

pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27503.

Severity

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-30 21:20 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
pdfforge	PDF Architect	Affected: 9.1.74.23030

Date Public

2025-12-11 20:36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14416",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T21:20:34.563772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T21:20:40.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PDF Architect",
          "vendor": "pdfforge",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.74.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:40:45.755Z",
      "datePublic": "2025-12-11T20:36:03.401Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27503."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:22:31.525Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1073",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1073/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14416",
    "datePublished": "2025-12-23T21:22:31.525Z",
    "dateReserved": "2025-12-10T01:40:45.626Z",
    "dateUpdated": "2025-12-30T21:20:40.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14415 (GCVE-0-2025-14415)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:24 – Updated: 2026-01-02 13:40

Title

Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability

Summary

Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27494.

Severity

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-02 13:39 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Soda PDF	Desktop	Affected: 14.0.509.23030

Date Public

2025-12-11 20:48

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14415",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T13:39:52.159430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T13:40:00.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Desktop",
          "vendor": "Soda PDF",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.509.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:39:12.532Z",
      "datePublic": "2025-12-11T20:48:09.264Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27494."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:24:19.116Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1088",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1088/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14415",
    "datePublished": "2025-12-23T21:24:19.116Z",
    "dateReserved": "2025-12-10T01:39:12.511Z",
    "dateUpdated": "2026-01-02T13:40:00.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14414 (GCVE-0-2025-14414)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:24 – Updated: 2025-12-26 14:21

Title

Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Word files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27496.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-26 14:21 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Soda PDF	Desktop	Affected: 14.0.509.23030

Date Public

2025-12-11 20:48

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-26T14:21:46.637870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-26T14:21:53.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Desktop",
          "vendor": "Soda PDF",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.509.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:39:08.248Z",
      "datePublic": "2025-12-11T20:48:03.985Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Word files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27496."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:24:58.103Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1087",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1087/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14414",
    "datePublished": "2025-12-23T21:24:58.103Z",
    "dateReserved": "2025-12-10T01:39:08.229Z",
    "dateUpdated": "2025-12-26T14:21:53.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14412 (GCVE-0-2025-14412)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:24 – Updated: 2025-12-24 15:37

Title

Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-24 15:37 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Soda PDF	Desktop	Affected: 14.0.509.23030

Date Public

2025-12-11 20:47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-24T15:37:33.139354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-24T15:37:39.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Desktop",
          "vendor": "Soda PDF",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.509.23030"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:39:00.775Z",
      "datePublic": "2025-12-11T20:47:52.860Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:24:04.860Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1085",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1085/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14412",
    "datePublished": "2025-12-23T21:24:04.860Z",
    "dateReserved": "2025-12-10T01:39:00.752Z",
    "dateUpdated": "2025-12-24T15:37:39.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14404 (GCVE-0-2025-14404)

Vulnerability from cvelistv5 – Published: 2025-12-23 21:21 – Updated: 2025-12-30 21:19

Title

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability

Summary

PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498.

Severity

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-30 21:19 UTC

CWE

CWE-356 - Product UI does not Warn User of Unsafe Actions

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
PDFsam	Enhanced	Affected: 7.0.76.15222

Date Public

2025-12-11 20:58

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T21:19:33.683896Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T21:19:40.721Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enhanced",
          "vendor": "PDFsam",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.76.15222"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-10T01:37:20.322Z",
      "datePublic": "2025-12-11T20:58:48.004Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-356",
              "description": "CWE-356: Product UI does not Warn User of Unsafe Actions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-23T21:21:19.483Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-25-1092",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1092/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "kimiya"
      },
      "title": "PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2025-14404",
    "datePublished": "2025-12-23T21:21:19.483Z",
    "dateReserved": "2025-12-10T01:37:20.278Z",
    "dateUpdated": "2025-12-30T21:19:40.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation

Architecture and Design

Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list