SQL Injection Vulnerability in erzhongxmu JEEWMS Search Endpoint
CVE-2026-108775

5.3MEDIUM

Key Information:

Vendor

Erzhongxmu

Status
Jeewms
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108775?

A critical vulnerability exists in erzhongxmu JEEWMS affecting the Search Endpoint's WvNoticeController.list function. This issue arises from improper handling of the 'searchstr' argument, allowing attackers to manipulate SQL queries executed against the database. Remote exploitation is possible, which may lead to unauthorized data access or other malicious actions. The vulnerability has been publicly disclosed, and the vendor has not taken steps to address the issue despite being alerted.

Affected Version(s)

JEEWMS 2026.09.27-W39

References

https://vuldb.com/vuln/416556
vdb-entrytechnical-description
https://vuldb.com/vuln/416556/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108775
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lib0gus (VulDB User)
VulDB CNA Team
.