CVE-2026-38165-SSTI-

CVE-2026-38165 SSTI Velocity Inyección de Plantillas del Lado del Servidor SSTI en XDocReport permite Ejecución Remota de Código a través del motor Apache Velocity Definición del error Resumen de la vulnerabilidad Server-Side Template Injection SSTI es una vulnerabilidad de seguridad web que...

CVE-2025-64087-SSTI-

CVE-2025-64087 SSTI FreeMarker XDocReportにおけるServer-Side Template Injection SSTI により、Apache FreeMarkerエンジンを介したリモートコード実行が可能 バグの定義 脆弱性の概要 Server-Side Template Injection SSTI は、Webアプリケーションのセキュリティ脆弱性であり、コンテンツ管理システム（CMS）やWebフレームワークで使用されるテンプレートに悪意のあるコードを注入し、リモートからの攻撃、機密情報の取得、またはシステムへの侵入操作を実行することを可能にします...

CVE-2025-65482-XXE-

CVE-2025-65482 XXE XML External Entity Injection XXE in XDocReport Bug Definition XML External Entity Injection 漏洞概述 XML外部实体注入（XXE）是一种处理XML格式数据时的漏洞，用户插入引用外部文件或系统的XML数据。攻击者可以利用此已识别的XXE漏洞扫描其他系统的开放服务端口，请求机密文件，并访问已连接系统的功能（这些功能原本不可用）。由此，攻击者可以提取数据、与系统交互，并通过XML注入造成服务中断。 业务影响...

EUVD-2026-60545

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

PT-2026-76878

Name of the Vulnerable Software and Affected Versions xdocreport versions 0.9.2 through 2.2.0 Description A Server-Side Template Injection SSTI issue exists in the Velocity template engine configuration. This allows attackers to execute arbitrary code by providing a crafted expression. SSTI is a...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

GHSA-7JC7-G598-2P64 XDocReport affected by an XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

XDocReport affected by an XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

GHSA-R8W2-W357-9PJV XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

br.com.jarch:jarch-apt (>=20.3.0, <=24.1.0), br.com.jarch:jarch-core (>=20.3.0, <=24.1.0) +32 more potentially affected by CVE-2025-65482 via fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx (>=0.9.5, <=2.2.0)

fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx MAVEN version =0.9.5, =20.3.0, =20.3.0, =2.23.5, =24.2.0, =23.1.0, =2.23.0, =2.0, =2.0, =2.0, =2.2.4, =2.0, =2.2.4, =2.2.4, =2.2.4, =2.2.7 and more Source cves: CVE-2025-65482 Source advisory: SNYK:JAVA-FROPENSAGRESXDOCREPORT-1504671...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087

The CVE-2025-64087 SSTI issue affects the FreeMarker component in opensagres XDocReport v1.0.0–v2.1.0, enabling arbitrary code execution via crafted template expressions. The vulnerability has CVSS v3.1 metrics: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8 (CRITICAL). Affected versions inc...