CVE-2026-9524

MediumCVSS 6.3

Published: 26/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

EasyReport up to version 2.0.17.0522_Beta has an SQL injection vulnerability in the REST Endpoint component via the reportParams argument. The attack can be performed remotely, and the vendor did not respond.

Risk Assessment

An attacker can remotely manipulate the database, potentially leading to data leakage, modification, or deletion.

Recommendation

Immediately stop using the vulnerable version and apply available patches or replace the software with a more secure solution.

Other vulnerabilities in EasyReport

CVE-2026-75876Medium
A SQL injection vulnerability has been detected in EasyReport up to 2.0.17.0522_Beta, in ModuleController.java, within Move Operations. Manipulation of the sourcePath argument allows remote attack. The exploit has been publicly disclosed, and the project has not responded.

Original NVD description (English source)

A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS