CVE-2026-108782 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The issue exists in the CommonServiceImpl.getAutoList function of the Autocomplete Handler component, where manipulation of the argument trem/searchField/entityName can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or provided a fix.
CVE-2026-108781 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmToMoveGoodsController.list function of the PDA Interface component, where manipulation of the searchstr argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but there is no vendor response or patch at this time.
CVE-2026-108779 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the WmSttInGoodsController.list function. The vulnerability arises from unsafe manipulation of the 'searchstr' argument, allowing remote attackers to perform SQL injection. The affected version is 2026.09.27-W39. Public exploit code exists, but there is no vendor response or patch available as of the publication date.
CVE-2026-108778 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmInQmIController.list function of the Inbound Quality Check Pda Interface component, where manipulation of the 'searchstr' argument allows SQL injection. The vulnerability can be exploited remotely without user interaction and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
CVE-2026-108775 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the WvNoticeController.list function within the Search Endpoint component, where the searchstr argument is improperly handled, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, and no vendor response or patch is currently available.
CVE-2026-108774 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the getbinall/getbinallagv functions of MdBinController.java, where manipulation of certain input parameters can lead to SQL injection. The vulnerability can be exploited remotely and exploit code has been published. The vendor has not responded to disclosure and no patch or fix information is available.
CVE-2026-108773 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the docheck function of the WmOmNoticeHController.java file, where manipulation of the goodscode argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to disclosure requests, and no patch or official fix is currently documented. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.