JEEWMS CVE-2026-108773

Exploitation requires a valid authenticated session on the JEEWMS application (CVSS PR:L), after which the attacker reaches the docheck handler in WmOmNoticeHController.java and supplies a malicious 'goodscode' argument that is concatenated into a SQL query. Limiting factors: the attacker must first possess low-privileged credentials (not anonymous/unauthenticated), the flaw is confined to the specific 'goodscode' parameter of this controller, and only versions up to 2026.09.27-W39 are indicated as affected; no user interaction is needed and the endpoint is network-reachable. No non-default configuration is reported as necessary beyond having the WM/notice functionality in use.

This is a classic high-CVSS-perception-but-modest-real-risk case, and the signals are unusually consistent in pointing to LOW priority. The sole provided CVSS is a CVSS 4.0 vector scoring only 2.1 (Low): AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L and E:P (Proof-of-Concept exploit maturity). The network vector and low complexity ease exploitation, but PR:L means the attacker must already hold a valid (low-privileged) authenticated session, and all three impact sub-metrics are only Low - not the High/complete-database-compromise rating a SQL injection sometimes earns, suggesting the injectable 'goodscode' parameter yields limited data access rather than full DBMS takeover. Exploitation status: publicly available exploit code exists (description states 'The exploit is now public' and vector carries E:P), but this is NOT active exploitation - there is no CISA KEV listing and no EPSS score was provided, so widespread or automated attack cannot be asserted. The signals do not conflict: a low base score, authenticated prerequisite, a niche product, and only a POC (not in-the-wild use) all align toward a low-urgency, patch-on-normal-cycle item. Note the vendor 'did not respond' to disclosure, so no official fix or advisory is confirmed - this raises remediation friction even though intrinsic severity is low. EPSS and KEV data are MISSING/absent from the input and should be checked directly before final prioritization.

An authenticated low-privileged user of a JEEWMS deployment submits a crafted value in the 'goodscode' parameter handled by the docheck function in WmOmNoticeHController.java, injecting SQL that the backend executes against the database. Because a public proof-of-concept exists, an attacker with any valid account could adapt it to read or tamper with limited warehouse/notice data remotely. Exploitation is network-reachable and low-complexity but gated by the requirement for an existing authenticated session.