CVE-2026-38158
A critical SQL injection flaw exists in the /ureport/datasource/previewData component of ureport version 2.2.9. Attackers can send specially crafted SQL statements to read or manipulate the underlying database, potentially exposing sensitive data. The vulnerability carries a CVSS base score of 9.8, indicating a severe risk, though no public exploit or known active exploitation has been reported.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
ureport v2.2.9 (specific component /ureport/datasource/previewData)
Real-world impact
Unauthenticated remote attackers could access, modify, or delete database contents, leading to data breach, loss of integrity, or service disruption.
Why this severity
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network‑reachable attack with low complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources