CVE-2026-75979
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was found in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the execSqlText/previewSqlText functions in DesignerController.java (SQL Preview Endpoint). Manipulation of the sqlText argument results in improper neutralization of special elements used in a template engine, potentially allowing remote attack. The exploit has been made public, and the project has not responded.
Risk Assessment
A remote attacker could exploit this to perform unauthorized operations on the server, including data reading or modification, potentially compromising system security.
Recommendation
Immediately restrict access to the SQL Preview endpoint, apply vendor patches if available, and implement input validation.
Original NVD description (English source)
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.