The first case is on websites that allow user input to be part of the PDF ... Java, and .NET --besides PHP. The researcher says he reported the vulnerability (CVE-2018-17057) to the TCPDF library ...