JEEWMS EUVD-2026-97132

Exploitation requires a valid authenticated session on the JEEWMS application (CVSS PR:L), after which the attacker sends a malicious value in the 'searchstr' argument to the WvGiController.list endpoint; no special non-default configuration or user interaction is required (UI:N). The key limiting factor is the authentication requirement - an attacker must first obtain low-privilege credentials or an active account, which bounds this to insiders or attackers who have otherwise acquired access, rather than fully anonymous internet-wide exploitation.

This is a CWE-89 SQL injection in the JEEWMS WvGiController.list function via the 'searchstr' parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L), meaning an authenticated user - not an anonymous attacker. Impact is assessed as partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a MEDIUM base score of 5.3, which is consistent with authenticated low-impact SQLi rather than a critical pre-auth breach. The E:P exploit-maturity flag and the description ('The exploit has been made public') confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - public PoC availability and active exploitation are distinct signals. There is no SSVC decision data, no EPSS probability, and no vendor patch (the vendor was contacted but did not respond). On balance this is a real but moderate-priority issue: a credentialed SQL injection in a niche open-source product with a public PoC but no confirmed in-the-wild exploitation and no fix available. The sole source is VulDB, so corroboration is limited.

An attacker who already holds a low-privilege authenticated account on a JEEWMS instance submits a crafted value in the 'searchstr' parameter to the WvGiController list endpoint, injecting SQL that is executed by the backend database. Because a public exploit has been released, a low-skilled attacker can reuse it to read or tamper with warehouse data. The attack is remote over the network but gated behind valid credentials (PR:L).