CVE-2026-3028: erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3028?
CVE-2026-3028 is classified as a cross-site scripting (XSS) vulnerability, which can lead to significant security risks.
How do I fix CVE-2026-3028?
To fix CVE-2026-3028, sanitize user inputs in the doAdd function of JeecgListDemoController.java to prevent injection of malicious scripts.
What software versions are affected by CVE-2026-3028?
CVE-2026-3028 affects all versions of erzhongxmu JEEWMS up to and including 3.7.
Can the CVE-2026-3028 vulnerability be exploited remotely?
Yes, CVE-2026-3028 can be exploited remotely due to the nature of the cross-site scripting vulnerability.
What impact does CVE-2026-3028 have on users?
The impact of CVE-2026-3028 includes the potential for attackers to steal sensitive information such as cookies or session tokens.