A SQL injection flaw exists in the docheck() function of the WmOmNoticeHController within erzhongxmu JEEWMS. By manipulating the goodscode argument, an attacker can inject arbitrary SQL, potentially allowing modification, disclosure, or destruction of data stored by the application. The weakness is identified as a typical input validation flaw (CWE-74) that directly leads to SQL injection (CWE-89).

The vulnerability affects erzhongxmu JEEWMS versions up to and including 2026.09.27-W39. No additional version information is available from the vendor. The affected component is the WmOmNoticeHController class, located in the src/main/java/com/zzjee/wm/controller package.

The flaw carries a CVSS score of 5.3 indicating medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely against the exposed docheck endpoint. Because the injection point is a public API parameter, exploitation does not require authentication. The public nature of the exploit increases the likelihood that attackers may attempt to use it in the wild. Security teams should treat this as a moderate- to high-risk exposure until a patch or mitigations are applied.