Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SQL Injection in ureport v2.2.9 Exposes Database Info

CVE-2026-38158 · published 3 months ago
Summary

The /ureport/datasource/previewData component of ureport v2.2.9 has a security weakness that could allow unauthorized access to sensitive database information. This is a serious issue because it could lead to the theft of confidential data. To protect yourself, update to a fixed version of ureport or apply the recommended security patches.

Original advisory text
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published16 Jul 2026
Updated30 Oct 2026
First seen16 Jul 2026
Sources
CVE-2026-38158 · NVD
CVE-2026-38158 · MITRE
Track software like this
Free during beta