PT-2026-43180 · Xianrendzw · Easyreport

Ku4D3 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-9524

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522 Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing a manipulation of the argument reportParams can lead to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-9524

Affected Products

Easyreport

References · 4

• https://vuldb.com/vuln/365543 · Note
• https://github.com/Ku4D3/bug_story/blob/main/report_10.md · Note
• https://vuldb.com/submit/814567 · Note
• https://vuldb.com/vuln/365543/cti · Note