🚨 CRITICAL - SQL Injection in ureport datasource previewData endpoint (CVE-2026-38158) A SQL injection vulnerability exists in ureport v2.2.9 within the /ureport/datasource/previewData component that handles datasource preview queries. The root cause is improper input validation/unsafely constructed SQL statements, allowing attacker-controlled input to be executed by the database. An attacker can exploit this by sending crafted SQL payloads to the previewData endpoint (often reachable over HTTP in deployed report servers), requiring only network access to the application and whatever minimal access that endpoint permits. Successful exploitation can lead to unauthorized database reads and sensitive data exposure, and depending on DB permissions and configuration may enable broader compromise of backend data stores. 👉 Affected: ureport v2.2.9 | Upgrade to No fix yet - treat as suspicious
Post summary
A critical SQL injection vulnerability was disclosed in ureport v2.2.9's previewData endpoint, with no fix yet and no indications of PoC, exploit tools, or active exploitation.