CVE-2026-108775
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated attackers can read, modify, or delete database contents via SQL injection over the network. They only need low-privilege network access to reach the search endpoint.
Root cause
The searchstr parameter in the WvNoticeController.list function is concatenated directly into SQL queries without sanitization.
Affected systems
erzhongxmu JEEWMS up to 2026.09.27-W39
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch exists as the vendor did not respond. Block or restrict network access to the /wmapi/wvNoticeController/list endpoint using a WAF or reverse proxy rule.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.