CVE-2026-108778
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read or modify database contents using SQL injection. They only need low-privilege network access to the Inbound Quality Check PDA Interface.
Root cause
The WmInQmIController.list endpoint fails to sanitize user input passed to the searchstr parameter before executing a SQL query.
Affected systems
erzhongxmu JEEWMS up to 2026.09.27-W39
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No fixed version is available since the vendor did not respond. Restrict network access to the Inbound Quality Check PDA Interface or block requests containing the searchstr parameter on /WmInQmIController at your web application firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.