CVE-2026-3027: erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting
A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3027?
CVE-2026-3027 is classified as a high-severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2026-3027?
To fix CVE-2026-3027, update the erzhongxmu JEEWMS software to a version later than 3.7 to mitigate the risk of cross-site scripting.
What components are affected by CVE-2026-3027?
CVE-2026-3027 affects the UEditor component found in the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp.
What type of vulnerability is CVE-2026-3027?
CVE-2026-3027 is a cross-site scripting (XSS) vulnerability that allows attackers to execute malicious scripts.
Can CVE-2026-3027 be exploited remotely?
Yes, CVE-2026-3027 can be exploited remotely, making it a significant security concern.