Vulnerability · Published Oct 11, 2026 · Assigned by VulDB
CVE-2026-108778erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in JEEWMS from erzhongxmu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| erzhongxmu | JEEWMS | 2026.09.27-W39 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
References
- VDB-416558 | erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection vdb-entry, technical-description
- VDB-416558 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-108778 | CVE Analysis and Report third-party-advisory
- Submit #959616 | erzhongxmu JEEWMS 3.7 SQL Injection third-party-advisory