CVE-2026-75979

Name of the Vulnerable Software and Affected Versions xianrendzw EasyReport versions prior to 2.0.17.0522 Beta

Description Improper neutralization of special elements used in a template engine occurs within the SQL Preview Endpoint component. A remote attacker can manipulate the sqlText argument in the execSqlText() or previewSqlText() functions located in the DesignerController.java file to execute the attack.

Recommendations As a temporary workaround, restrict access to the execSqlText() and previewSqlText() functions in the DesignerController.java file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.