CVE-2026-75876: medium-severity vulnerability in xianrendzw EasyReport
xianrendzw EasyReport Move Operations ModuleController.java sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
xianrendzw · EasyReportpublic PoCs found — 1
cve_referencegithub.com/xianrendzw/EasyReport/issues/84unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — xianrendzw EasyReport
In the same product, most dangerous first.
CVE-2026-75979MEDIUMxianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engineEPSS 0.4%CVE-2026-75978MEDIUMxianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permissionEPSS 0.4%CVE-2026-9524MEDIUMxianrendzw EasyReport REST Endpoint execute sql injectionEPSS 0.2%