Description
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.
Published: 2026-07-16
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection flaw exists in the uReport 2.2.9 endpoint /ureport/datasource/previewData, which permits an attacker to inject arbitrary SQL commands. The vulnerability can lead to the disclosure of confidential database tables and data, compromising the confidentiality and integrity of the underlying information system.

Affected Systems

The issue affects installations of uReport version 2.2.9. No additional vendor product details are available from the provided data.

Risk and Exploitability

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is lower than 1 %, suggesting a currently low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over HTTP, requiring crafted input to the previewData endpoint.

Generated by OpenCVE AI on July 31, 2026 at 02:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade uReport to a version that includes the SQL injection fix.
  • Ensure the database user account used by uReport has the minimal privileges required and does not allow SELECT on sensitive tables.
  • Implement input validation or a Web Application Firewall rule to block offensive SQL syntax on the previewData endpoint.

Generated by OpenCVE AI on July 31, 2026 at 02:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Youseries
Youseries ureport
Vendors & Products Youseries
Youseries ureport

Fri, 31 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title SQL injection in uReport 2.2.9 previewData endpoint

Tue, 28 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title SQL Injection in uReport 2.2.9 PreviewData Endpoint

Sat, 25 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title SQL Injection in uReport 2.2.9 PreviewData Endpoint

Fri, 17 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.
References

Subscriptions

Youseries Ureport
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-17T13:35:47.954Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38158

cve-icon Vulnrichment

Updated: 2026-07-17T13:35:42.986Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:22:50Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')