CVE-2026-108782: erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection
A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
JEEWMS versions up to and including 2026.09.27-W39 are identified as affected. The issue is in the Autocomplete Handler's CommonServiceImpl.getAutoList function.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires the ability to manipulate the trem, searchField, or entityName arguments handled by the affected function. The supplied data does not state whether authentication or any particular application role is required.
Is public exploit code available?
Yes. The exploit has been made public, increasing the likelihood that the issue could be used in attacks.
What should teams do if they cannot immediately patch?
The provided information does not identify a vendor fix or workaround. Prioritize restricting access to the affected autocomplete functionality and investigate or filter requests that manipulate the trem, searchField, or entityName parameters.