CVE-2026-108778: erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection
A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects erzhongxmu JEEWMS versions up to 2026.09.27-W39, specifically the Inbound Quality Check Pda Interface code path handled by WmInQmIController.list.
What does an attacker need to exploit this?
The attack can be performed remotely by manipulating the searchstr argument. The vulnerability has a low attack complexity rating, but the supplied severity vector indicates that low privileges are required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What should teams do if they cannot obtain a vendor fix?
The vendor reportedly did not respond to the disclosure. Prioritize restricting access to the affected interface to trusted, authenticated users and monitor requests containing unusual searchstr values, while assessing whether the affected controller can be disabled or isolated.