CVE-2026-108779: erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection
A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack can be performed remotely, but the supplied CVSS vector indicates that an attacker needs low-level privileges. No user interaction is required.
Which deployments should be considered affected?
erzhongxmu JEEWMS versions up to 2026.09.27-W39 are identified as affected. The vulnerable code is the WmSttInGoodsController.list function, where the searchstr argument can be manipulated.
Is exploitation likely to be practical?
The attack complexity is rated low, and a public exploit is available. This makes exposure more urgent for reachable instances where a low-privileged account can access the affected function.
What is the potential impact of a successful attack?
The provided severity vector rates confidentiality, integrity, and availability impact as low. Successful SQL injection may therefore affect all three areas to a limited extent.