SQL Injection Vulnerability in erzhongxmu JEEWMS by Erzhongxmu
CVE-2026-108782

5.3MEDIUM

Key Information:

Vendor

Erzhongxmu

Status
Jeewms
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108782?

A significant SQL injection vulnerability has been discovered in the erzhongxmu JEEWMS application, specifically within the Autocomplete Handler component. The flaw resides in the function CommonServiceImpl.getAutoList, where improper handling of input parameters could permit malicious actors to manipulate the application's SQL queries via the trem/searchField/entityName argument. This leads to unauthorized access and potential data breaches. The vulnerability can be exploited remotely, making it a severe risk to users of the affected versions. Despite early notification to the vendor regarding this flaw, there has been no response, leaving users exposed to possible attacks.

Affected Version(s)

JEEWMS 2026.09.27-W39

References

https://vuldb.com/vuln/416561
vdb-entrytechnical-description
https://vuldb.com/vuln/416561/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108782
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

test996 (VulDB User)
VulDB CNA Team
.