EUVD-2026-97131
GHSA-gjf5-vwv7-jrqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend crafted searchstr to WvNoticeController.list
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExecute query against backend database
-
ImpactRead or modify limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on the JEEWMS application (CVSS PR:L) and the ability to reach the Search Endpoint handled by WvNoticeController.list; the attacker supplies a malicious 'searchstr' request parameter to the notice-list search function. No special non-default configuration is indicated - any deployment exposing the authenticated search endpoint appears affected. Limiting factors: the requirement for low-privileged credentials (not unauthenticated), no user interaction needed, and impact bounded to the privileges of the application's database account (Low C/I/A), which constrains realistic damage. |
| Impact | Signals are modest and internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection that nonetheless requires authentication (PR:L), and impact is capped at Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a medium base score of 5.3. The E:P exploit-maturity flag plus the description's statement that 'the exploit has been disclosed to the public' confirm publicly available exploit code exists, but there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active, widespread exploitation. The requirement for valid low-privileged credentials materially lowers real-world risk versus an unauthenticated SQLi, and the vendor (erzhongxmu) did not respond to disclosure, meaning no patch is confirmed available. Net assessment: a real but moderate issue - prioritize for organizations actually running JEEWMS, but it is not a drop-everything emergency given authentication prerequisites, Low impact metrics, and absence of KEV/active-exploitation evidence. Note the single-source nature (VulDB only) warrants independent confirmation of affected versions and fix status. |
| Exploit ScenarioDerived | An authenticated user with a low-privilege JEEWMS account sends a crafted value in the 'searchstr' parameter to the WvNoticeController.list search endpoint, injecting SQL that is executed against the backend database. Public exploit code exists, lowering the effort required to reproduce the attack. Because impact is rated Low, the attacker can likely read or alter limited database content accessible to the application's DB user rather than fully compromising the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
SQL injection in erzhongxmu JEEWMS (warehouse management system) through 2026.09.27-W39 lets an authenticated remote user inject arbitrary SQL via the 'searchstr' argument of the notice search endpoint handled by WvNoticeController.list. Publicly available exploit code exists, and the maintainer was contacted early but did not respond, so no vendor-supplied fix has been published; there is no indication of confirmed active exploitation (no CISA KEV entry). Impact is bounded by the privileges of the application's database account (Low confidentiality, integrity, and availability), and exploitation requires a valid low-privileged session (CVSS PR:L).
RemediationAI
No vendor-released patch identified at time of analysis: the JEEWMS maintainer was contacted early about the disclosure and did not respond, and no fixed version is referenced in the advisory data, so remediation must currently be handled by the deploying organization. The durable fix is a source-level change in WvNoticeController.list that replaces string concatenation of the 'searchstr' parameter with parameterized queries (JDBC PreparedStatement bind variables, JPA criteria/parameter binding, or an equivalent ORM-safe construct) plus input validation on the search term; deploy this as a local patch or fork until upstream publishes a version. Until then, apply compensating controls with their trade-offs: restrict network reachability of the search endpoint to trusted management networks or VPN and place it behind an authenticating reverse proxy (reduces exposure but does not stop an already-authenticated malicious insider or a hijacked session); enforce strong authentication and session protections and monitor/limit low-privileged accounts, since exploitation requires a valid session (PR:L); tighten the application's database account to the minimum required privileges, using a read-only role for search workloads where the application tolerates it - this can break legitimate write operations in related modules; deploy WAF/ModSecurity rules or a request filter that rejects SQL metacharacters and boolean/UNION patterns in the 'searchstr' parameter, accepting that such rules may cause false positives on legitimate free-text notice searches; and enable database and application logging for anomalous query patterns to detect attempts. Review the advisory references at https://vuldb.com/vuln/416556 and https://vuldb.com/cve/CVE-2026-108775 for any later fix guidance, and treat the publicly available exploit code as a reason to prioritize these controls on internet-facing or partner-accessible JEEWMS instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JEEWMS is a Java-based open-source warehouse management system whose web layer is built on Spring MVC-style controllers; the affected component is the Search Endpoint implemented by the method WvNoticeController.list in com/zzjee/wmapi/controller/WvNoticeController.java. The flaw is a classic CWE-89 SQL injection: the 'searchstr' request parameter is incorporated into a database query without proper parameterization or escaping, so attacker-controlled text alters the query's structure rather than being treated as data. Because the code sits behind the authenticated API surface, the request must carry a valid session, but no special non-default configuration is required - any deployment that exposes the notice-list search function is affected. The CPE entry (cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:*) uses a wildcard version, indicating that no fixed version boundary has been published, consistent with the vendor's non-response. Successful injection executes with the rights of the application's database connection, which normally limits the achievable impact to the data and operations that account can reach.
Know when Jeewms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable search endpoint (AV:N/AC:L) requires a valid low-privilege login (PR:L) with no user interaction; SQLi yields limited read/write data impact (C/I/A:L), no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. R
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information vi
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. Rated medium severity (CVSS 6.9), this v
A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute a
Jeewms 3.7 contains a server-side request forgery vulnerability in the UEditor plugin's getRemoteImage.jsp file, where t
Code injection in erzhongxmu JeeWMS via the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) all
Unauthenticated remote access to the Spring Boot Actuator endpoint in erzhongxmu JeeWMS exposes sensitive application in
A vulnerability was found in erzhongxmu Jeewms up to 20241108. Rated medium severity (CVSS 5.3), this vulnerability is r
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical.html o
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet
Reflected cross-site scripting in Jeewms up to version 3.7 exists in the UEditor component's getContent.jsp file through
Cross-site scripting (XSS) in the doAdd function of Jeewms up to version 3.7 allows unauthenticated remote attackers to
Exploit-DB