JEEWMS EUVD-2026-97130

Exploitation requires a valid authenticated JEEWMS session with at least low-level privileges (CVSS PR:L): the attacker must be able to reach the getbinall or getbinallagv endpoints backed by MdBinController.java and supply an attacker-controlled value in one of the binstore, binid, des, or cengshu request parameters, which is concatenated into a SQL query without sanitization. Limiting factors that reduce real-world risk: the attacker needs working credentials (no anonymous/unauthenticated path per PR:L), the JEEWMS web interface must be network-reachable to the attacker, and impact is rated Low across confidentiality/integrity/availability rather than full database compromise. No special non-default configuration is called out in the description, so default deployments exposing these endpoints to authenticated users are affected.

This is a moderate-risk, authenticated SQL injection (CWE-89) in the JEEWMS warehouse management application, and the signals are largely consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 and indicates a network-reachable, low-complexity attack that nonetheless REQUIRES low-level privileges (PR:L) - i.e. the attacker must already hold a valid, if unprivileged, authenticated session. That authentication requirement is the single biggest factor tempering real-world risk and explains the only-partial C/I/A impact ratings. The E:P flag in the vector plus the description statement that 'the exploit has been published and may be used' confirm publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, in-the-wild exploitation - the POC should not be conflated with confirmed exploitation. Net: a real, actionable issue for anyone running JEEWMS (patch/mitigate because working exploit code is public and the vendor is unresponsive), but not a drop-everything internet-wide emergency given the authentication prerequisite, low per-category impact, and the product's narrow deployment footprint. EPSS and KEV data are absent from the input, so widespread-exploitation likelihood cannot be quantified and is assessed as low-to-unknown.

An attacker who already holds a low-privileged authenticated account on a JEEWMS instance sends a request to the getbinall or getbinallagv functionality with a malicious value in the binstore, binid, des, or cengshu parameter, injecting SQL that the MdBinController passes unsanitized into a database query. Because published exploit code exists and the attack complexity is low, a logged-in user (or an attacker who has phished/obtained any valid credential) could extract or tamper with warehouse database contents remotely without additional user interaction.