SQL Injection

Overview com.bstek.ureport:ureport2-console is an UReport2 is a high-performance pure Java report engine based on Spring architecture, where complex Chinese-style statements and reports can be prepared by iterating over cells. Affected versions of this package are vulnerable to SQL Injection...

com.gccloud:gc-starter-plugins-report-controller (>=1.0.0-beta, <=2.2.2.release), com.gccloud:gc-starter-plugins-report-server (>=1.0.0-beta, <=1.2.4.2024062001.release) +11 more potentially affected by CVE-2026-38158 via com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-console MAVEN version =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2026-38158 Source advisory: SNYK:JAVA-COMBSTEKUREPORT-18748794...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

EUVD-2023-54920

Malicious code in bioql PyPI...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

Design/Logic Flaw

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

CVE-2023-50090

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

CVE-2023-50090

Affected product: ureport2, version 2.2.9 and earlier. Vulnerability: Arbitrary File Write in the saveReportFile method, exploitable via crafted POST requests; enables writing arbitrary files and running arbitrary commands. Impact: high confidentiality, integrity, and availability risks; CVSS v3....

PT-2024-13856 · Ureport2 · Ureport2

Name of the Vulnerable Software and Affected Versions: ureport2 versions 2.2.9 and before Description: The issue allows attackers to write arbitrary files and run arbitrary commands via a crafted POST request. This is due to an Arbitrary File Write vulnerability in the saveReportFile method...

CVE-2023-50090: Undefined Security Weakness

Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-48848 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-48848 Source advisory: OSV:GHSA-9VFC-QXC8-WRPQ...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-48848 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-48848 Source advisory: GHSA-9VFC-QXC8-WRPQ...

XML External Entity (XXE)

UReport2 Core Project is vulnerable to XML External Entity XXE. The vulnerability exists due to the parse function in ReportPaser.java because the interface for saving reports does not sanitize external entity references when parsing XML data allowing an attacker to submit a malicious XML file...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-24187 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-24187 Source advisory: OSV:GHSA-FHJ6-GR87-G4CJ...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-24187 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-24187 Source advisory: GHSA-FHJ6-GR87-G4CJ...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-24188 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-24188 Source advisory: OSV:GHSA-6FCJ-9VFW-JQ2M...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-24188 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-24188 Source advisory: GHSA-6FCJ-9VFW-JQ2M...