CVE-2026-11457: erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection
A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
erzhongxmu JeeWMS JimuReportfrom your environment.Uninstall or remove the JimuReport component if it is not required to eliminate exposure of the vulnerable /base-boot/jmreport/testConnection endpoint.
- Configuration
Disable the /base-boot/jmreport/testConnection endpoint in application configuration or via feature flag if the endpoint is not required.
JimuReport test-connection Endpoint enabled = false - Configuration
If the endpoint cannot be removed, restrict access to /base-boot/jmreport/testConnection to trusted/internal IPs and require strong authentication in the application or reverse proxy.
JimuReport test-connection Endpoint access_control = restrict to trusted IPs / require authentication - Compensating control
Deploy WAF rules or web application filtering to block injection patterns targeting /base-boot/jmreport/testConnection (validate or block payloads in dbType/dbDriver/dbUrl/dbUsername/dbPassword parameters) and restrict access at the network firewall to only trusted sources.
- Operational
Rotate any database credentials (dbUsername/dbPassword) that may have been used with the test-connection endpoint and perform an audit of application and database logs for suspicious activity or signs of exploitation against /base-boot/jmreport/testConnection.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11457?
The severity of CVE-2026-11457 is rated as high with a score of 7.3.
How do I fix CVE-2026-11457?
To fix CVE-2026-11457, update the erzhongxmu JeeWMS software to the latest version where this vulnerability is patched.
What component is affected by CVE-2026-11457?
CVE-2026-11457 affects the test-connection endpoint of the JimuReport component in erzhongxmu JeeWMS.
What type of injection is associated with CVE-2026-11457?
CVE-2026-11457 involves an injection vulnerability related to manipulating the dbType/dbDri argument.
When was CVE-2026-11457 published?
CVE-2026-11457 was published on June 7, 2026.