6 matches found
CVE-2026-94109
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...
CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...
EUVD-2026-83731
openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or...
CVE-2026-94109
openEQUELLA versions before 2026.1.0 are affected by a remote code execution vulnerability in FreeMarker template compilation, caused by an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions via collection summaries , dashboard portl...
CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...