The vulnerability exists in the WmInQmIController.list function of the JEEWMS Inbound Quality Check Pda Interface. A manipulated searchstr argument can be crafted to inject arbitrary SQL statements, allowing a remote attacker to execute commands against the database. This can lead to data exposure, data modification, or denial of service through the malfunctioning application logic. The impact is limited to the database and the application but can be leveraged for larger compromise if the database credentials are misconfigured or privilege escalation is possible.

The affected product is erzhongxmu JEEWMS, version up to 2026.09.27-W39. All instances of the product running this or earlier releases are vulnerable.

The CVSS score of 5.3 indicates a moderate severity level. EPSS is not available, and the vulnerability is not listed in CISA KEV. The description states the attack is possible to be carried out remotely and the exploit has been publicly disclosed, implying it can be leveraged by adversaries with external network access. Vendor response was absent, increasing the risk that attackers already use the flaw. The combination of remote attack surface and lack of a public patch increases overall risk perception for deployed systems.