Dreamreport is a modestly represented vendor whose vulnerability footprint concentrates in a narrowly scoped product line centered on its Dream Report application and Remote Connector, both of which handle user-supplied input and configuration permissions. The recurring weakness classes—incorrect default permissions, cross-site scripting in web-page generation, and related input-handling issues—reflect exposure patterns typical of web-based reporting and data-connector tools where input validation and access control boundaries carry particular importance to defenders. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dreamreport over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-4039HIGH Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execut | Feb 10, 2012 | 9.3 | 28 | NO | NO |
CVE-2021-21957HIGH A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to | Dec 8, 2021 | 7.3 | 24 | NO | NO |
CVE-2020-13534HIGH A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 wit | Apr 9, 2021 | 7.8 | 20 | NO | NO |
CVE-2020-13533HIGH A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can | Apr 9, 2021 | 7.8 | 20 | NO | NO |
CVE-2020-13532HIGH A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to e | Apr 9, 2021 | 7.8 | 20 | NO | NO |
CVE-2011-4038MEDIUM Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, all | Feb 10, 2012 | 4.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dreamreport.
Media articles that mention a CVE ID that affects a product developed by Dreamreport — matched by CVE ID, not by vendor name.