br.com.jarch:jarch-apt (>=20.3.0, <=24.1.0), br.com.jarch:jarch-core (>=20.3.0, <=24.1.0) +32 more potentially affected by CVE-2025-65482 via fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx (>=0.9.5, <=2.2.0)

fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx MAVEN version =0.9.5, =20.3.0, =20.3.0, =2.23.5, =24.2.0, =23.1.0, =2.23.0, =2.0, =2.0, =2.0, =2.2.4, =2.0, =2.2.4, =2.2.4, =2.2.4, =2.2.7 and more Source cves: CVE-2025-65482 Source advisory: SNYK:JAVA-FROPENSAGRESXDOCREPORT-1504671...

XDocReport security vulnerabilities

XDocReport is an open-source XML document reporting software developed by opensagres. Versions 0.9.2 to 2.0.3 of XDocReport have security vulnerabilities. These vulnerabilities stem from XML external entity vulnerabilities, which may allow arbitrary code to be executed by uploading a specially...

PT-2026-3620

Name of the Vulnerable Software and Affected Versions opensagres XDocReport versions 1.0.0 through 2.1.0 Description A Server-Side Template Injection SSTI flaw exists in the FreeMarker component. This allows attackers to execute arbitrary code by injecting crafted template expressions. The affect...

XDocReport security vulnerabilities

XDocReport is an open-source XML document reporting software developed by opensagres. There are security vulnerabilities in the XDocReport version 1.0.0 to 2.1.0; these vulnerabilities stem from server-side template injection in the FreeMarker component, which may allow arbitrary code to be...

CVE-2025-65482

The opensagres XDocReport library (versions v0.9.2 to v2.0.3 ) contains an XML External Entity (XXE) vulnerability within the fr.opensagres.xdocreport.document.docx component. The root cause is the use of a SAXParser to process uploaded .docx files without disabling DTDs or external entities. Att...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087

A Server-Side Template Injection (SSTI) vulnerability exists in the FreeMarker component of opensagres XDocReport versions v1.0.0 to v2.1.0 . The root cause is the lack of input validation or sandboxing when processing .docx templates; the application directly passes untrusted content from the do...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

PT-2026-3629

Name of the Vulnerable Software and Affected Versions opensagres XDocReport versions 0.9.2 through 2.0.3 Description An XML External Entity XXE issue exists in opensagres XDocReport. Successful exploitation allows attackers to execute arbitrary code by uploading a specially crafted .docx file. Th...

CVE-2025-65482: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087: Improper Neutralization of Special Elements Used in a Template Engine

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

CVE-2025-64087

A Server-Side Template Injection SSTI vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions...

CVE-2025-65482

An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...

Exploit for CVE-2025-65482

CVE-2025-65482 XXE XML External Entity Injection XXE in...

Exploit for CVE-2025-64087

CVE-2025-64087 SSTI FreeMarker Server-Side Template Injec...

XML External Entity (XXE) Injection

Opensagres XDocReport Document is vulnerable to XML external entity injection. The vulnerability exists in preprocess function in SAXXDocPreprocessor because the XML parser is not properly configured which allows an attacker to inject malicious XML input via weakly configured parser...