SQL Injection Vulnerability in erzhongxmu JEEWMS from Vendor
CVE-2026-108778

5.3MEDIUM

Key Information:

Vendor

Erzhongxmu

Status
Jeewms
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108778?

A vulnerability has been identified in the erzhongxmu JEEWMS system, specifically impacting the WmInQmIController.list function. The flaw occurs within the argument searchstr, allowing attackers to manipulate inputs and execute SQL injection remotely. This vulnerability poses a significant risk as it can be exploited over the internet, potentially leading to unauthorized access to sensitive databases and data breach scenarios. Despite notifying the vendor regarding this issue, there has been no response or patch issued, heightening the urgency for users to implement protective measures.

Affected Version(s)

JEEWMS 2026.09.27-W39

References

https://vuldb.com/vuln/416558
vdb-entrytechnical-description
https://vuldb.com/vuln/416558/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108778
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HYap (VulDB User)
VulDB CNA Team
.