CVE-2026-38158
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.
Risk Assessment
An attacker can read, modify, or delete confidential data from the database, leading to a breach of data confidentiality and integrity for the organization.
Recommendation
Immediately update ureport to the latest available version that includes a fix for this vulnerability. Additionally, implement input validation and use prepared statements to prevent SQL injection attacks.
Original NVD description (English source)
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.