Description
A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection enabling data compromise
Action: Assess Impact
AI Analysis

Impact

A vulnerability exists in the WmToMoveGoodsController.list method of the PDA Interface component, where the searchstr argument is concatenated into an SQL query without proper sanitization. This flaw corresponds to input manipulation weaknesses (CWE‑74) and classic SQL injection (CWE‑89). An attacker can inject arbitrary SQL that will be executed on the backend database, potentially allowing data exfiltration, modification, or denial of service. This impact is limited to the scope of the affected application and database.

Affected Systems

The affected product is erzhongxmu JEEWMS, specifically the PDA Interface module of the WmToMoveGoodsController. All versions up to 2026.09.27‑W39 are vulnerable. The vulnerability is triggered when a remote client supplies a crafted searchstr parameter to the list action. No vendor‑released fix is currently public.

Risk and Exploitability

The CVSS score is 5.3, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely via the PDA Interface, and the public exploit code has already been released. Because the vendor has not responded, the risk remains high until a patch or mitigation is applied.

Generated by OpenCVE AI on October 12, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Implement input validation or use parameterized queries for the searchstr argument in WmToMoveGoodsController.list to eliminate concatenated SQL.
  • Apply any available vendor patch for erzhongxmu JEEWMS after 2026.09.27‑W39; if no patch exists, consider replacing or isolating the vulnerable component.
  • Deploy a web‑application firewall rule set that detects and blocks typical SQL injection patterns against the PDA Interface endpoint.

Generated by OpenCVE AI on October 12, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Erzhongxmu
Erzhongxmu jeewms
Vendors & Products Erzhongxmu
Erzhongxmu jeewms

Mon, 12 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection
First Time appeared Jeewms
Jeewms jeewms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:jeewms:jeewms:*:*:*:*:*:*:*:*
Vendors & Products Jeewms
Jeewms jeewms
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Erzhongxmu Jeewms
Jeewms Jeewms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T00:15:17.758Z

Reserved: 2026-10-11T08:05:47.998Z

Link: CVE-2026-108781

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T01:16:29.783

Modified: 2026-10-12T01:16:29.783

Link: CVE-2026-108781

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T02:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')