SQL Injection Vulnerability in erzhongxmu JEEWMS Affected by Remote Exploitation
CVE-2026-108777

5.3MEDIUM

Key Information:

Vendor

Erzhongxmu

Status
Jeewms
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108777?

A security flaw in erzhongxmu JEEWMS allows for SQL injection via the WvGiController.list function. Exploiting this vulnerability enables remote attackers to manipulate the searchstr parameter, potentially leading to unauthorized access to sensitive data. The vulnerability has been publicly disclosed, and the vendor has not responded to initial reports, raising concerns about the urgency for users to patch their systems.

Affected Version(s)

JEEWMS 2026.09.27-W39

References

https://vuldb.com/vuln/416557
vdb-entrytechnical-description
https://vuldb.com/vuln/416557/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108777
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lib0gus (VulDB User)
VulDB CNA Team
.