Tags: #object-injection

CVE-2019-14670 - LimeSurvey TCPDF RCE via PHAR File

Remote code execution in LimeSurvey < 3.17 through TCPDF PHAR deserialization attack, exploiting queXML PDF export functionality.