CVE-2026-108774

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-74, CWE-89

Impact

Authenticated remote attackers can read or modify backend database contents via SQL injection. Public exploit code is already available.

Root cause

Improper sanitization of user-supplied arguments (binstore, binid, des, cengshu) in MdBinController.java allows SQL injection.

Affected systems

erzhongxmu JEEWMS up to 2026.09.27-W39

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

No vendor patch is available; restrict network access to the JEEWMS application and block untrusted traffic to MdBinController endpoints.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108774