Threat Intelligence Database

CVE-2026-108782 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the CommonServiceImpl.getAutoList function of the Autocomplete Handler component. The vulnerability affects version 2026.09.27-W39 and allows remote attackers to manipulate input parameters to execute SQL injection attacks. Exploit code has been publicly disclosed, but the vendor has not responded or provided a fix.

CVE-2026-108781 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmToMoveGoodsController.list function within the PDA Interface component, where manipulation of the 'searchstr' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and has publicly available exploit code. The vendor was notified but has not responded or provided a patch.

CVE-2026-108779 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the WmSttInGoodsController.list function. The vulnerability allows remote attackers to manipulate the 'searchstr' argument to perform SQL injection. The affected version is 2026.09.27-W39. The vendor has not responded to disclosure requests, and no patch or fix information is currently available. Exploit code is publicly available but no known exploitation in the wild has been reported.

CVE-2026-108778 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. It affects the Inbound Quality Check Pda Interface component, specifically the WmInQmIController.list function. The vulnerability arises from improper handling of the searchstr argument, allowing remote attackers to perform SQL injection. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or provided a fix.

CVE-2026-108775 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the WvNoticeController.list function. The vulnerability arises from improper handling of the 'searchstr' argument, allowing remote attackers to inject SQL commands. The affected version is 2026.09.27-W39. The vendor has not responded to the disclosure, and no patch or remediation is currently available. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

CVE-2026-108774 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the getbinall/getbinallagv functions of MdBinController.java, where manipulation of certain input arguments can lead to SQL injection. The vulnerability can be exploited remotely, and a public exploit is available. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.

CVE-2026-108773 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the docheck function of the WmOmNoticeHController.java file. The vulnerability affects version 2026.09.27-W39 and allows remote attackers to manipulate the 'goodscode' argument to perform SQL injection. The exploit code is publicly available, but no vendor response or patch has been provided.

A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityChinaIndiaUnited States+7#cve#cve-2026-3028

A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityChinaUnited StatesIndia+7#cve#cve-2026-3026