jsreport vulnerabilities

Products

• jsreport 2
• jsreport-chrome-pdf 1
• jsreport/jsreport 1
• phantom-html-to-pdf 1

Latest jsreport CVEs

Newest publication first

1. CVE-2023-2583 Code Injection in jsreport/jsreport

   Published 2023-05-08

   Critical·CVSS 10.0

   Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.

2. CVE-2020-7763 Arbitrary File Read

   Published 2020-11-05

   High·CVSS 7.5

   This affects the package phantom-html-to-pdf before 0.6.1.

3. CVE-2020-7762 Arbitrary File Read

   Published 2020-11-05

   Medium·CVSS 6.5 EPSS 1.6%

   This affects the package jsreport-chrome-pdf before 1.10.0.

4. CVE-2020-8128 Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport

   Published 2020-02-14

   Critical·CVSS 9.8 EPSS 2.7%

   An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.