CVE-2026-75978: medium-severity vulnerability in xianrendzw EasyReport
xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.4%
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
xianrendzw · EasyReportpublic PoCs found — 1
cve_referencegithub.com/xianrendzw/EasyReport/issues/83unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — xianrendzw EasyReport
In the same product, most dangerous first.
CVE-2026-75979MEDIUMxianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engineEPSS 0.4%CVE-2026-75876MEDIUMxianrendzw EasyReport Move Operations ModuleController.java sql injectionEPSS 0.3%CVE-2026-9524MEDIUMxianrendzw EasyReport REST Endpoint execute sql injectionEPSS 0.2%