An SQL injection flaw exists in the getbinall and getbinallagv functions of the MdBinController.java component of erzhongxmu JEEWMS, allowing an attacker to inject arbitrary SQL through the binstore, binid, des, or cengshu parameters. This can cause unauthorized reading or modification of database contents, exposing sensitive inventory data. The flaw is a classic code‑injection issue classified under CWE-74 and CWE-89.

erzhongxmu JEEWMS is impacted for all versions up to and including 2026.09.27-W39. The specific vulnerable code resides in src/main/java/com/zzjee/md/controller/MdBinController.java. No other products or versions are listed as affected.

According to the CVSS score of 5.3 the severity is moderate, but the vulnerability may be exploited remotely as the description states, and an exploit has already been published. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, meaning there is no current evidence of large‑scale exploitation. Therefore, while the potential for data disclosure exists, the likelihood and impact are lower than high‑risk conditions but should still be addressed promptly.