CVE-2026-38158
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.
Risk Assessment
An attacker can read, modify, or delete confidential data from the database, leading to a breach of data confidentiality and integrity for the organization.
Recommendation
Immediately update ureport to the latest available version that includes a fix for this vulnerability. Additionally, implement input validation and use prepared statements to prevent SQL injection attacks.
Other vulnerabilities in ureport
See all- CVE-2023-24188Critical
A directory traversal vulnerability was discovered in ureport version 2.2.9 within the deletion function, allowing arbitrary file deletion.
- CVE-2023-24187High
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code by uploading a crafted XML file to /ureport/designer/saveReportFile.
Original NVD description (English source)
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.