The vulnerability exists in the WvNoticeController.list function, where the searchstr argument is not properly sanitized, enabling attackers to inject arbitrary SQL. This flaw permits remote attackers to execute SQL commands against the database, potentially exposing sensitive data or altering application state. The weakness is an example of CWE‑89 SQL injection triggered by improper handling of user input (CWE‑74).

Agents using erzhongxmu's JEEWMS product before or including the 2026.09.27‑W39 revision are affected. The component is the Search Endpoint exposed by the WvNoticeController. No specific vendor patch is listed yet, so any instance running a vulnerable version remains at risk.

The CVSS base score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog, but the description confirms that exploitation is possible over the network and the public exploit has been disclosed. Attackers can craft a malformed searchstr parameter in a HTTP request to the Search Endpoint, leading to unauthorized SQL execution. Given the absence of a publicly available patch, the risk remains until a fix or mitigation is applied.