CVE-2026-124504 in erupt

Prediction

by VulDB Data Team • 11/08/2026

A vulnerability was detected in <a href="/product/erupts:erupt">erupts erupt up to 2.3.0</a>. Affected by this issue is the function <code>ReportService.queryBiData</code> of the file <em>ReportService.java</em>. Performing a manipulation of the argument <em>sort</em> results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named <em>8d2eaffc79b977c9d11222b9d435a002dceaa062</em>. It is suggested to upgrade the affected component.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-432808
• CPE: VulDB
• CWE: CWE-89 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-124504
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124504
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-124504/