CVE-2025-65482

The opensagres XDocReport library (versions v0.9.2 to v2.0.3 ) contains an XML External Entity (XXE) vulnerability within the fr.opensagres.xdocreport.document.docx component. The root cause is the use of a SAXParser to process uploaded .docx files without disabling DTDs or external entities. Att...

CVE-2025-64087

A Server-Side Template Injection (SSTI) vulnerability exists in the FreeMarker component of opensagres XDocReport versions v1.0.0 to v2.1.0 . The root cause is the lack of input validation or sandboxing when processing .docx templates; the application directly passes untrusted content from the do...