CVE-2026-108775: erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely over the network and does not require user interaction. However, the listed CVSS vector indicates that the attacker needs low-level privileges before exploitation.
Which installations are known to be affected?
erzhongxmu JEEWMS versions up to and including 2026.09.27-W39 are identified as affected. The vulnerable functionality is the Search Endpoint handled by WvNoticeController.list.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What input should be investigated for signs of attempted exploitation?
Review requests to the JEEWMS search endpoint that invoke WvNoticeController.list, particularly values supplied in the searchstr argument. The reported issue is SQL injection through manipulation of that parameter.