CVE-2026-108782 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The issue exists in the CommonServiceImpl.getAutoList function of the Autocomplete Handler component, where manipulation of the argument trem/searchField/entityName can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but the vendor has not responded or provided a fix.
CVE-2026-108781 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmToMoveGoodsController.list function of the PDA Interface component, where manipulation of the searchstr argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but there is no vendor response or patch at this time.
CVE-2026-108779 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically in the WmSttInGoodsController.list function. The vulnerability arises from unsafe manipulation of the 'searchstr' argument, allowing remote attackers to perform SQL injection. The affected version is 2026.09.27-W39. Public exploit code exists, but there is no vendor response or patch available as of the publication date.
CVE-2026-108778 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the WmInQmIController.list function of the Inbound Quality Check Pda Interface component, where manipulation of the 'searchstr' argument allows SQL injection. The vulnerability can be exploited remotely without user interaction and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
CVE-2026-108777 is a SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting the WvGiController.list function. The vulnerability arises from unsafe manipulation of the 'searchstr' argument, allowing remote attackers to execute SQL injection attacks. The affected version is 2026.09.27-W39. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed, but no vendor response or patch is currently available.
CVE-2026-108775 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the WvNoticeController.list function within the Search Endpoint component, where the searchstr argument is improperly handled, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, and no vendor response or patch is currently available.
CVE-2026-108774 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the getbinall/getbinallagv functions of MdBinController.java, where manipulation of certain input parameters can lead to SQL injection. The vulnerability can be exploited remotely and exploit code has been published. The vendor has not responded to disclosure and no patch or fix information is available.
CVE-2026-108773 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the docheck function of the WmOmNoticeHController.java file, where manipulation of the goodscode argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to disclosure requests, and no patch or official fix is currently documented. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-108684 is a medium severity SQL injection vulnerability in erzhongxmu Jeewms affecting versions 3.0 through 3.7. The flaw exists in the getTreeData function of the Autocomplete Data Handler component, specifically in the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. An attacker can remotely manipulate the searchVal argument to execute SQL injection. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available to fix this issue.
A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.