JEEWMS CVE-2026-108781

Exploitation requires an authenticated session (CVSS PR:L) with access to the PDA Interface endpoint served by WmToMoveGoodsController.list; the attacker must be able to reach this interface over the network and supply the 'searchstr' request parameter, which is passed unsanitized into a SQL query. The limiting factor is the low-privilege authentication requirement - this is not an unauthenticated flaw - so exposure depends on who holds valid JEEWMS accounts and whether the PDA interface is network-reachable. No special non-default configuration is indicated in the description; any JEEWMS instance at or below version 2026.09.27-W39 with this controller appears affected.

This is a SQL injection (CWE-89) in the niche open-source JEEWMS warehouse management system, and the signals point to a moderate, non-urgent priority rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) yields only 5.3 because, although the attack is network-based and low-complexity, it requires authentication (PR:L) and the vendor-assessed impact to confidentiality, integrity, and availability is each rated Low rather than High - unusual for SQLi, which often enables full database read. The E:P (Proof-of-Concept) sub-score aligns with the description's statement that an exploit has been publicly released, so publicly available exploit code exists. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation; the PoC availability is a distinct signal from confirmed in-the-wild use. No SSVC decision data was supplied. Net: a credentialed attacker can likely exploit this with little effort, but the low impact ratings, authentication requirement, and obscure product footprint keep real-world risk modest. One caveat to verify: the Low CVI/I/A ratings seem conservative for an SQL injection, which can frequently extract or alter arbitrary database contents - organizations running JEEWMS should treat potential impact as possibly higher than the 5.3 suggests and confirm with testing.

An authenticated low-privilege user of a JEEWMS deployment sends a crafted value in the 'searchstr' parameter to the PDA Interface endpoint handled by WmToMoveGoodsController.list, injecting SQL that the backend executes against the database. Because public exploit code has been released, this requires minimal skill to reproduce. The attacker can then read or manipulate warehouse/database records accessible to the injected query.