CVE-2026-108779
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote users can execute arbitrary SQL queries against the backend database, potentially reading or tampering with application data. The exploit is publicly available.
Root cause
The WmSttInGoodsController.list function fails to sanitize or parameterize the 'searchstr' input parameter before executing a SQL query.
Affected systems
erzhongxmu JEEWMS up to 2026.09.27-W39
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch is currently available from the vendor. Restrict network access to the application, or block requests to the WmSttInGoodsController.list endpoint at your reverse proxy or WAF until a fix can be applied.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.