CVE-2026-75978
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the DataSourceController.add function in DataSourceController.java (QueryerFactory component). Manipulation of the queryerClass argument leads to permission issues, potentially allowing remote attack. The exploit has been publicly disclosed, and the project has not responded.
Risk Assessment
An attacker could exploit this to gain unauthorized privileges, potentially leading to data integrity compromise or system takeover.
Recommendation
Restrict access to the DataSourceController function, apply vendor patches if available, and conduct a permission audit.
Original NVD description (English source)
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.