CVE-2022-25767: UREPORT2 Project UREPORT2

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.

Affected products

Published 2022-05-01. Last modified 2026-06-17.