Which versions of JeeWMS are affected by EUVD-2026-34987?

JeeWMS contains an unauthenticated code injection vulnerability in its JimuReport test-connection endpoint that permits remote attackers to execute arbitrary code and compromise database credentials…

Is there a public PoC exploit available for EUVD-2026-34987?

Yes, a public proof-of-concept exploit is available for EUVD-2026-34987. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-34987?

Within 24 hours: Conduct enterprise-wide asset inventory to identify all JeeWMS deployments; immediately restrict network access to /base-boot/jmreport/testConnection endpoint using firewall rules or reverse proxy ACLs to authorized administrative networks only. Within 7 days: Deploy Web Application Firewall rules to block code injection patterns in the dbType, dbDriver, dbUrl, dbUsername, and dbPassword parameters; implement real-time alerting on endpoint access attempts and database configuration changes; test disabling the endpoint if operational reporting can function without it. Within 30 days: Escalate vendor engagement requesting security patch timeline and release commitment; complete evaluation and transition plan to alternative reporting solutions; document business justification for any continued operation of vulnerable JeeWMS instances.

JeeWMS EUVD-2026-34987

Q: What is the CVSS score of EUVD-2026-34987?

EUVD-2026-34987 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-11457 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-07 VulDB

GHSA-2wr2-6xmq-jw4h

Code Injection Jeewms

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 09:22 NVD

HIGH MEDIUM

CVSS changed

Jun 07, 2026 - 09:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 07, 2026 - 08:43 vuln.today

DescriptionCVE.org

A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in erzhongxmu JeeWMS via the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) allows remote unauthenticated attackers to inject malicious payloads through the dbType, dbDriver, dbUrl, dbUsername, and dbPassword parameters. Publicly available exploit code exists and the vendor did not respond to disclosure, leaving deployments exposed without a confirmed patched build due to the project's rolling-release model.

Technical ContextAI

JeeWMS is an open-source warehouse management system that embeds the JimuReport reporting component, which exposes a database test-connection endpoint intended to validate JDBC connectivity. The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection), where user-controlled fields such as dbDriver and dbUrl are passed through to lower-level database/driver handling without adequate sanitization. JDBC URL parameters and driver-class loading historically enable a range of injection paths - including driver-side property injection and arbitrary class loading - when an application accepts untrusted JDBC connection metadata. The affected CPE is cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:* spanning all releases up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69.

RemediationAI

No vendor-released patch identified at time of analysis - the maintainer did not respond to disclosure and the rolling-release model provides no tagged fix version. Operators should pull the latest commit from the upstream JeeWMS repository and review it for any post-disclosure mitigation, but this fix is not independently confirmed. As immediate compensating controls, block external access to the /base-boot/jmreport/testConnection endpoint at the reverse proxy or WAF (side effect: report-builder users will lose the ability to validate new database connections from the UI), restrict the entire /base-boot/jmreport/* path to authenticated administrator sessions on a trusted network segment, and remove or disable the JimuReport integration entirely if the reporting feature is unused (side effect: report functionality is lost). Monitor outbound network connections from the application server for unexpected JDBC traffic to attacker-controlled hosts and review the public report at https://vuldb.com/vuln/369076 for any updated indicators.