Description
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a SQL injection flaw in the sourcePath argument of ModuleController.java within the Move Operations module of xianrendzw EasyReport. By supplying a crafted value, an attacker can cause the application to include untrusted input directly into an SQL statement, allowing arbitrary queries or modifications to the database. The flaw can compromise the confidentiality and integrity of the data stored by the application.

Affected Systems

All installations of EasyReport up to 2.0.17.0522_Beta are affected. Versions released after that milestone that have fixed the unsafe handling of sourcePath are not impacted.

Risk and Exploitability

The flaw is exploitable remotely; an attacker only needs the ability to send requests to the affected endpoint. The publicly disclosed exploit demonstrates that the vulnerability can be used in the wild. With a CVSS score of 5.3, the risk is moderate, and the lack of an EPSS score or KEV listing means there is currently no quantitative data on exploitation frequency. Until the vendor issues an official patch, the threat remains significant.

Generated by OpenCVE AI on August 18, 2026 at 21:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor’s website for a newer EasyReport release that removes the sourcePath injection risk and upgrade if available.
  • If no update exists, modify the application to validate or sanitize the sourcePath parameter and use prepared statements for all database queries that incorporate this value.
  • Restrict access to the Move Operations endpoint to authenticated, authorized users only and employ least‑privilege database credentials to limit the impact of any successful injection.
  • Set up logging and monitoring to detect anomalous SQL queries that could indicate exploitation attempts.

Generated by OpenCVE AI on August 18, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title xianrendzw EasyReport Move Operations ModuleController.java sql injection
First Time appeared Xianrendzw
Xianrendzw easyreport
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:xianrendzw:easyreport:*:*:*:*:*:*:*:*
Vendors & Products Xianrendzw
Xianrendzw easyreport
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Xianrendzw Easyreport
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T13:38:44.244Z

Reserved: 2026-08-18T12:32:38.581Z

Link: CVE-2026-75876

cve-icon Vulnrichment

Updated: 2026-08-19T13:38:40.120Z

cve-icon NVD

Status : Deferred

Published: 2026-08-18T20:17:33.093

Modified: 2026-08-20T12:48:31.843

Link: CVE-2026-75876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T21:45:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')