CVE-2026-108684: SQL Injection in erzhongxmu Jeewms
Description
CVE-2026-108684 is a SQL injection vulnerability in erzhongxmu Jeewms affecting versions 3.0 through 3.7. The flaw exists in the getTreeData function of the JeecgFormDemoController.java file, specifically in the Autocomplete Data Handler component. An attacker can remotely manipulate the searchVal argument to perform SQL injection. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available to fix this issue. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
CVSS v4.0
Score 5.3medium
Affected software
erzhongxmu
Jeewms
pkg:github/erzhongxmu/Jeewmscpe:2.3:a:jeewms:jeewms:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-108684 in erzhongxmu Jeewms up to version 3.7 is a SQL injection flaw in the getTreeData function within src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. It affects the Autocomplete Data Handler component. By manipulating the searchVal argument, an attacker can inject SQL commands remotely. The issue is addressed by a patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0, which should be applied to remediate the vulnerability.
Potential Impact
Successful exploitation allows remote attackers to perform SQL injection via the searchVal parameter, potentially leading to unauthorized database queries or data exposure. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3, indicating a moderate impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Apply the official patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 to versions 3.0 through 3.7 of erzhongxmu Jeewms. This patch addresses the SQL injection vulnerability in the getTreeData function. No additional vendor advisory content is provided, so patch status is confirmed by the presence of the patch commit reference.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-10T21:29:15.771Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acba1e22cdf04f656dc4209
Added to database: 10/11/2026, 14:49:06 UTC
Last enriched: 10/11/2026, 15:03:20 UTC
Last updated: 10/11/2026, 15:08:17 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.