A vulnerability enables attackers to inject arbitrary SQL statements by manipulating the searchstr parameter in the WvGiController.list function. Because the value is incorporated directly into a query without proper escaping or parameterization, an attacker could retrieve, modify, or delete data from the underlying database, leading to loss of confidentiality, integrity, or availability. This flaw falls under CWE-74 and CWE-89. The impact is remote, as the endpoint is reachable over the network.

Impacting the erzhongxmu JEEWMS application version up to 2026.09.27-W39. The affected component is the WvGiController within the main Java source. No narrower product version details are available beyond the specified release date, but all installations of JEEWMS running before or at that version are vulnerable.

With a CVSS score of 5.3, this SQL injection is categorized as moderate severity. The EPSS score is unavailable, and the vulnerability is not currently listed in CISA's KEV catalog, indicating no known widespread exploitation reports yet. However, the public exploit code has been released, and the flaw can be triggered remotely on any exposed instance, so the likelihood of exploitation is non‑negligible in environments where the JEEWMS instance is internet‑accessible. The attacker would need network access to the application server to reach the vulnerable endpoint and supply a crafted searchstr value.