Threat Intelligence Database

CVE-2026-75979 is a medium severity vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta. It affects the execSqlText and previewSqlText functions in the DesignerController.java file, specifically the SQL Preview Endpoint component. The vulnerability arises from improper neutralization of special elements used in a template engine when processing the sqlText argument, allowing remote attackers to exploit this flaw. Although the issue was reported early to the project, no response or patch has been provided yet. Public exploit code exists but there is no evidence of active exploitation in the wild.

CVE-2026-75978 is a medium severity security vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta. It involves permission issues caused by manipulation of the argument queryerClass in the DataSourceController.add function within the DataSourceController.java file of the QueryerFactory component. The vulnerability can be exploited remotely and public exploit code is available. The vendor has been informed but has not yet provided a response or fix.

CVE-2026-75876 is a medium severity SQL injection vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta. The flaw exists in the ModuleController.java file within the Move Operations component, where manipulation of the sourcePath argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code has been disclosed, but the vendor has not yet responded or issued a fix.