CVE-2026-108777
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read, modify, or delete database contents via SQL injection. Exploitation requires valid user credentials and network access to the web interface.
Root cause
The application fails to sanitize or parameterize the 'searchstr' input parameter in the WvGiController.list function before executing SQL queries.
Affected systems
erzhongxmu JEEWMS up to 2026.09.27-W39
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No vendor patch is currently available. Restrict network access to the application or block requests containing the 'searchstr' parameter to the WvGiController endpoint at your reverse proxy or web application firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.