CVE-2026-38158

The ureport reporting engine, specifically version 2.2.9 (package com.bstek.ureport:ureport2-console ), contains a SQL injection vulnerability in the /ureport/datasource/previewData component. The root cause is the insufficient validation of SQL statements and the use of unsafely constructed SQL ...