CVE-2026-108773
6.3MediumPublished 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can execute arbitrary SQL queries to read, modify, or corrupt database contents. Exploitation requires network access and low-privileged user credentials.
Root cause
Improper sanitization of the goodscode parameter in the docheck method of WmOmNoticeHController.java allows SQL injection.
Affected systems
erzhongxmu JEEWMS up to 2026.09.27-W39
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch is available from the vendor. Block or restrict network access to JEEWMS, or use a web application firewall to inspect and filter requests targeting the docheck endpoint for SQL injection patterns.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.