Threat Intelligence Database

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-75979 is a medium severity vulnerability in xianrendzw EasyReport version 2.0.17.0522_Beta. It involves improper neutralization of special elements in a template engine within the execSqlText and previewSqlText functions of the SQL Preview Endpoint. This flaw allows remote attackers to manipulate the sqlText argument, potentially leading to security issues. The vulnerability has a publicly available exploit, but no official vendor response or patch has been issued yet.

CVE-2026-75978 is a medium severity security vulnerability in xianrendzw EasyReport version 2.0.17.0522_Beta. It involves permission issues caused by manipulation of the argument queryerClass in the DataSourceController.add function within the QueryerFactory component. The vulnerability can be exploited remotely. Although the issue was reported early to the project, no response or fix has been provided yet. Public exploit details are available, but there are no known exploits in the wild at this time.

CVE-2026-75876 is a medium severity SQL injection vulnerability in xianrendzw EasyReport version 2.0.17.0522_Beta. The flaw exists in the ModuleController.java file within the Move Operations component, where improper handling of the sourcePath argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, but the vendor has not yet responded or issued a patch.