CVE-2026-124504

MEDIUM 6.3

erupts erupt ReportService.java ReportService.queryBiData sql injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.

CWE	CWE-89 CWE-74
Vendor	erupts
Product	erupt
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for erupts erupt

Be the first to know when new medium vulnerabilities affecting erupts erupt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

erupts / erupt

2.0 2.1 2.2 2.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/432808 vuldb.com: https://vuldb.com/vuln/432808/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124504 vuldb.com: https://vuldb.com/submit/1035479 github.com: https://github.com/erupts/erupt/pull/485 github.com: https://github.com/erupts/erupt/commit/8d2eaffc79b977c9d11222b9d435a002dceaa062 github.com: https://github.com/erupts/erupt/releases/tag/2.4.0 github.com: https://github.com/erupts/erupt/

Credits

🔍 lucasg2g (VulDB User)