The vulnerability is an SQL injection flaw in the WmSttInGoodsController.list method of the JEEWMS application. Modifying the searchstr parameter can allow an attacker to inject SQL commands, potentially exposing, altering, or deleting data in the underlying database. This weakness follows the definition of CWE‑74 and CWE‑89, indicating that input is reflected directly into a SQL statement without proper sanitization.

The issue affects versions of the erzhongxmu JEEWMS application up to and including 2026.09.27‑W39. The vulnerable code resides in src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java and is accessed through the public web interface.

With a CVSS score of 5.3, the vulnerability is of moderate severity. The exploit is publicly available and can be performed remotely without requiring authentication. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the publicly disclosed nature indicates that attackers may already be leveraging it. The risk is therefore moderate to high due to the attack vector and potential database compromise.