Search
Find a vulnerability
Search criteria
8 vulnerabilities by xianrendzw
CVE-2026-75979 (GCVE-0-2026-75979)
Vulnerability from nvd – Published: 2026-08-19 00:45 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
Summary
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:35 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391897 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391897/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75979 | third-party-advisory |
| https://vuldb.com/submit/877844 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/82 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:35:48.904423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:58.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"SQL Preview Endpoint"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T00:45:08.237Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391897 | xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391897"
},
{
"name": "VDB-391897 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391897/cti"
},
{
"name": "CVE-2026-75979 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75979"
},
{
"name": "Submit #877844 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta remote code execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877844"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/82"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T20:24:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75979",
"datePublished": "2026-08-19T00:45:08.237Z",
"dateReserved": "2026-08-18T18:19:04.585Z",
"dateUpdated": "2026-08-21T21:49:58.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75978 (GCVE-0-2026-75978)
Vulnerability from nvd – Published: 2026-08-19 00:00 – Updated: 2026-08-21 19:24
VLAI
EPSS
VEX
Title
xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission
Summary
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391893 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391893/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75978 | third-party-advisory |
| https://vuldb.com/submit/877797 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/83 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75978",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:24:36.188137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:24:51.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"QueryerFactory"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-275",
"description": "Permission Issues",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T00:00:13.664Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391893 | xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391893"
},
{
"name": "VDB-391893 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391893/cti"
},
{
"name": "CVE-2026-75978 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75978"
},
{
"name": "Submit #877797 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta remote code execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877797"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/83"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T20:20:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75978",
"datePublished": "2026-08-19T00:00:13.664Z",
"dateReserved": "2026-08-18T18:15:34.123Z",
"dateUpdated": "2026-08-21T19:24:51.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75876 (GCVE-0-2026-75876)
Vulnerability from nvd – Published: 2026-08-18 19:15 – Updated: 2026-08-19 13:38
VLAI
EPSS
VEX
Title
xianrendzw EasyReport Move Operations ModuleController.java sql injection
Summary
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 13:38 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391569 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391569/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75876 | third-party-advisory |
| https://vuldb.com/submit/877794 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/84 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75876",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T13:38:34.575763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T13:38:44.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"Move Operations"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:15:09.296Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391569 | xianrendzw EasyReport Move Operations ModuleController.java sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391569"
},
{
"name": "VDB-391569 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391569/cti"
},
{
"name": "CVE-2026-75876 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75876"
},
{
"name": "Submit #877794 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877794"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/84"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T14:37:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport Move Operations ModuleController.java sql injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75876",
"datePublished": "2026-08-18T19:15:09.296Z",
"dateReserved": "2026-08-18T12:32:38.581Z",
"dateUpdated": "2026-08-19T13:38:44.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9524 (GCVE-0-2026-9524)
Vulnerability from nvd – Published: 2026-05-26 02:45 – Updated: 2026-05-26 15:14
VLAI
EPSS
VEX
Title
xianrendzw EasyReport REST Endpoint execute sql injection
Summary
A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-26 15:14 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/365543 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/365543/cti | signaturepermissions-required |
| https://vuldb.com/submit/814567 | third-party-advisory |
| https://github.com/Ku4D3/bug_story/blob/main/repo… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:14:11.466945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:14:24.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"REST Endpoint"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ku4D3 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T02:45:10.253Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-365543 | xianrendzw EasyReport REST Endpoint execute sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/365543"
},
{
"name": "VDB-365543 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/365543/cti"
},
{
"name": "Submit #814567 | xianrendzw EasyReport Releases SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/814567"
},
{
"tags": [
"related"
],
"url": "https://github.com/Ku4D3/bug_story/blob/main/report_10.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-25T21:33:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport REST Endpoint execute sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-9524",
"datePublished": "2026-05-26T02:45:10.253Z",
"dateReserved": "2026-05-25T19:27:34.135Z",
"dateUpdated": "2026-05-26T15:14:24.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75979 (GCVE-0-2026-75979)
Vulnerability from cvelistv5 – Published: 2026-08-19 00:45 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
Summary
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:35 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391897 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391897/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75979 | third-party-advisory |
| https://vuldb.com/submit/877844 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/82 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:35:48.904423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:58.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"SQL Preview Endpoint"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-791",
"description": "Incomplete Filtering of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T00:45:08.237Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391897 | xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391897"
},
{
"name": "VDB-391897 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391897/cti"
},
{
"name": "CVE-2026-75979 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75979"
},
{
"name": "Submit #877844 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta remote code execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877844"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/82"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T20:24:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75979",
"datePublished": "2026-08-19T00:45:08.237Z",
"dateReserved": "2026-08-18T18:19:04.585Z",
"dateUpdated": "2026-08-21T21:49:58.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75978 (GCVE-0-2026-75978)
Vulnerability from cvelistv5 – Published: 2026-08-19 00:00 – Updated: 2026-08-21 19:24
VLAI
EPSS
VEX
Title
xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission
Summary
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391893 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391893/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75978 | third-party-advisory |
| https://vuldb.com/submit/877797 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/83 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75978",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:24:36.188137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:24:51.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"QueryerFactory"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-275",
"description": "Permission Issues",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T00:00:13.664Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391893 | xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391893"
},
{
"name": "VDB-391893 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391893/cti"
},
{
"name": "CVE-2026-75978 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75978"
},
{
"name": "Submit #877797 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta remote code execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877797"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/83"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T20:20:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75978",
"datePublished": "2026-08-19T00:00:13.664Z",
"dateReserved": "2026-08-18T18:15:34.123Z",
"dateUpdated": "2026-08-21T19:24:51.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75876 (GCVE-0-2026-75876)
Vulnerability from cvelistv5 – Published: 2026-08-18 19:15 – Updated: 2026-08-19 13:38
VLAI
EPSS
VEX
Title
xianrendzw EasyReport Move Operations ModuleController.java sql injection
Summary
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 13:38 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391569 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391569/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75876 | third-party-advisory |
| https://vuldb.com/submit/877794 | third-party-advisory |
| https://github.com/xianrendzw/EasyReport/issues/84 | exploitissue-tracking |
| https://github.com/xianrendzw/EasyReport/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75876",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T13:38:34.575763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T13:38:44.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"Move Operations"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ana10gy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:15:09.296Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391569 | xianrendzw EasyReport Move Operations ModuleController.java sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391569"
},
{
"name": "VDB-391569 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391569/cti"
},
{
"name": "CVE-2026-75876 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75876"
},
{
"name": "Submit #877794 | xianrendzw EasyReport \u003c=2.0.17.0522_Beta SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877794"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/xianrendzw/EasyReport/issues/84"
},
{
"tags": [
"product"
],
"url": "https://github.com/xianrendzw/EasyReport/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T14:37:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport Move Operations ModuleController.java sql injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75876",
"datePublished": "2026-08-18T19:15:09.296Z",
"dateReserved": "2026-08-18T12:32:38.581Z",
"dateUpdated": "2026-08-19T13:38:44.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9524 (GCVE-0-2026-9524)
Vulnerability from cvelistv5 – Published: 2026-05-26 02:45 – Updated: 2026-05-26 15:14
VLAI
EPSS
VEX
Title
xianrendzw EasyReport REST Endpoint execute sql injection
Summary
A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-26 15:14 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/365543 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/365543/cti | signaturepermissions-required |
| https://vuldb.com/submit/814567 | third-party-advisory |
| https://github.com/Ku4D3/bug_story/blob/main/repo… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianrendzw | EasyReport |
Affected:
2.0.17.0522_Beta
cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T15:14:11.466945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T15:14:24.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*"
],
"modules": [
"REST Endpoint"
],
"product": "EasyReport",
"vendor": "xianrendzw",
"versions": [
{
"status": "affected",
"version": "2.0.17.0522_Beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ku4D3 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T02:45:10.253Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-365543 | xianrendzw EasyReport REST Endpoint execute sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/365543"
},
{
"name": "VDB-365543 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/365543/cti"
},
{
"name": "Submit #814567 | xianrendzw EasyReport Releases SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/814567"
},
{
"tags": [
"related"
],
"url": "https://github.com/Ku4D3/bug_story/blob/main/report_10.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-25T21:33:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "xianrendzw EasyReport REST Endpoint execute sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-9524",
"datePublished": "2026-05-26T02:45:10.253Z",
"dateReserved": "2026-05-25T19:27:34.135Z",
"dateUpdated": "2026-05-26T15:14:24.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}