JEEWMS EUVD-2026-97133

Requires an authenticated low-privilege account (CVSS PR:L) with access to the Inbound Quality Check PDA interface; the attacker must be able to reach the WmInQmIController.list endpoint and supply the 'searchstr' request parameter, which is passed into a SQL query without sanitization. No user interaction is needed (UI:N) and no special non-default configuration is indicated. The primary limiting factor is the authentication requirement - this is NOT exploitable by fully unauthenticated attackers - which, combined with the product's niche deployment, meaningfully constrains real-world exploitation.

This is a LOW real-world priority despite being a remotely reachable SQL injection. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means a valid authenticated account is required - this is not an unauthenticated flaw. The vendor-assigned base score of 2.1 reflects only partial impacts (VC:L/VI:L/VA:L), a conservative VulDB rating that undersells typical SQLi potential; a single injection point can often be leveraged for broader database read/write than 'Low' implies, so defenders should treat the impact ceiling with some skepticism. Exploitation signals are mixed-to-weak: a public exploit exists (E:P in the vector), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation. The vulnerability is sourced solely from VulDB (CNA cna@vuldb.com) with no independent NVD enrichment, no vendor advisory, and no patch - the vendor was contacted but did not respond, meaning no official fix exists. Net: a genuine but authentication-gated bug in a niche product, worth patching/mitigating where JEEWMS is deployed, but not a broad emergency.

An attacker who holds (or obtains) low-privilege authenticated access to a JEEWMS instance submits a crafted value in the 'searchstr' parameter of the Inbound Quality Check PDA list endpoint, injecting SQL that the WmInQmIController.list function passes unsanitized into a database query. A public proof-of-concept exists, lowering the skill barrier, allowing extraction or manipulation of backend database contents. Because the attack vector is network-based with low complexity, it can be performed remotely over the application's normal web interface.